我正在使用以下6.x堆栈:
Filebeat-> Logstash-> Elastic-> Kibana
我正在尝试将filebeat / logstash配置为仅将特定日志文件发送到Elastic。现在看来,它正在发送所有内容。
当我看着Kibana时,我会看到大多数来自/ var / log / messages的消息。
Filebeat配置:
filebeat.inputs:
- type: log
enabled: true
paths:
#- /var/log/*.log
- /var/log/nginx/app.access.log
#- c:\programdata\elasticsearch\logs\*
output.logstash:
hosts: ["localhost:5044"]
index: logstash
Logstash配置:
input {
beats {
port => "5044"
}
}
filter {
grok {
match => {"message" => '%{IP:client} - %{USERNAME:username} \[%{HTTPDATE:timestamp}\] \"(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})\" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent} %{DATA: http_x_forwarded_for} %{DATA:gzip_ratio} rt=%{NUMBER:request_time} uct=%{NUMBER:upstream_connect_time} uht=%{NUMBER:upstream_header_time} urt=%{NUMBER:upstream_response_time} %{NUMBER:user_id}'}
}
grok {
match => {"request" => "\/dataset\/%{NUMBER:dataset_id}"}
}
kv {
source => "request"
field_split => "&?"
transform_key => "lowercase"
}
if "/search" in [request] and [q] {
mutate {add_field => {"search_action" => "search" }}
}
if [request] =~ "\/dataset\/%{NUMBER:dataset_id}" {
mutate {add_field => {"dataset_id" => dataset_id}}
}
mutate {
convert => {
"user_id" => "integer"
"dataset_id" => "integer"
}
# lowercase => [ "request" ]
}
}
output {
elasticsearch {
codec => "json"
hosts => ["127.0.0.1:9200"]
}
stdout { codec => rubydebug }
}
通过这种配置,我应该只将/var/log/nginx/app.access.log数据发送到Elastic吗?
在Kibana内,我可以看到来自多个日志文件的所有活动:
/ var / log / messages / var / log / secure
有什么想法为什么会这样,因为我真的找不到任何解决方案?
谢谢