Question

我有一个木偶服务器5.3，它登录到logstash。

每天我收到约9万条消息，其中95％是日志级别的INFO。我只想获得WARN和ERROR级别，但是不管我尝试什么，我仍然会得到INFOs。这就是我通过logback.xml将数据发送到logstash的方式：

<!-- This is the logstash part -->
<appender name="stash" class="net.logstash.logback.appender.LogstashSocketAppender">
  <host>logserverhostname.com</host>
  <port>514</port>
  <level>WARN</level>
</appender>
<!-- End of the logstash part -->

<root level="WARN">
    <appender-ref ref="stash" />
</root>

这是我检查Kibana时得到的：

message:{"@timestamp":"2019-03-26T12:54:13.493+01:00","@version":1,"message":"Puppet 'replace_facts' command for somehost.com submitted to PuppetDB with UUID 92ba53a7-83f2-4438-b1da-f39cd7ccc844","logger_name":"puppetserver","thread_name":"qtp1518931796-63","level":"INFO","level_value":20000,"HOSTNAME":"puppet-server.com"} severity_label:Emergency severity:0 tags:syslog, _grokparsefailure_sysloginput @timestamp:March 26th 2019, 12:54:13.492 priority:0 @version:1 facility_label:kernel host:IP.IP.IP.IP facility:0 _id:v6PZuWkBButu0N-H0QkS _type:doc _index:syslog-2019.03.26 _score: -

我可以在Kibana中过滤出结果，但我更希望不要向其提供无用的消息，从而节省了IO，网络流量和磁盘空间。

如何更改ELK的puppetserver日志级别

0 个答案: