Question

我想在下面的给定日志中删除包含单词“ HealthChecker”的日志行，并在有效负载中添加一些要发送到logstash的标签。

我的日志：

18.37.33.73 - - [18/Apr/2019:14:49:53 +0530] "GET /products?sort=date&direction=desc HTTP/1.1" 200 8543 "https://codingexplained.com/products/view/124" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit/602.1.38 (KHTML, like Gecko) Version/10.0 Mobile/14A300 Safari/602.1"
20.4.2.88 - - [18/Apr/2019:14:49:54 +0530] "GET / HTTP/1.1" 200 100332 "-" "ELB-HealthChecker/2.0"
18.37.33.73 - - [18/Apr/2019:14:49:55 +0530] "GET /products?sort=date&direction=desc HTTP/1.1" 200 8543 "https://codingexplained.com/products/view/124" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_0 like Mac OS X) AppleWebKit/602.1.38 (KHTML, like Gecko) Version/10.0 Mobile/14A300 Safari/602.1"
20.4.2.88 - - [18/Apr/2019:14:49:56 +0530] "GET / HTTP/1.1" 200 100332 "-" "ELB-HealthChecker/2.0"

我已经尝试在filebeat.yml文件的处理器插件中提供此配置，但是它仍然无法正常工作。

我的filebeat.yml文件：

filebeat.modules:
- module: apache
  access:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/location/apache_access_2017-09-28.log"]

    # Input configuration (advanced). Any input configuration option
    # can be added under this section.
    processors:
    - add_tags:
        tags: [web, production]
        target: "environment"
    - drop_event:
      when:
       contains:
         message: "ELB-HealthChecker"

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: false

output.console:
  # Boolean flag to enable or disable the output module.
  enabled: true
  codec.json:
    pretty: true

Answer 1

您的情况应归咎于YAML。 “处理器”是顶层元素，因此可以使用：

filebeat.modules:
- module: apache
  access:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/location/apache_access_2017-09-28.log"]

    # Input configuration (advanced). Any input configuration option
    # can be added under this section.

processors:
- add_tags:
    tags: [web, production]
    target: "environment"
- drop_event:
  when:
   contains:
     message: "ELB-HealthChecker"

如果不确定缩进，请参考filebeat.full.yml文件。

我想排除filebeat读取的日志中的某些行，并且还想通过在filebeat中使用处理器来添加标签，但是它不起作用

1 个答案: