引言:
之前博文介紹過了mysql/oracle與ES之間的同步機制。而logstash最初始的日志同步功能還沒有介紹。本文就logstash同步日志到ES做下詳細解讀。
1、目的:
将本地磁盤存儲的日志檔案同步(全量同步、實時增量同步)到ES中。
![](https://img.laitimes.com/img/__Qf2AjLwojIjJCLyojI0JCLicmbw5iM5gjNzQzN2QzNhhDNlVWOkN2M0EzYyAjYmRDO5gjN28CX5d2bs92Yl1iclB3bsVmdlR2LcNWaw9CXt92Yu4GZjlGbh5yYjV3Lc9CX6MHc0RHaiojIsJye.png)
2、源檔案:
[root@5b9dbaaa148a test_log]# ll
-rwxrwxrwx 1 root root 170 Jul 5 08:02 logmachine.sh
-rw-r--r-- 1 root root 66 Jul 5 08:25 MProbe01.log
-rw-r--r-- 1 root root 74 Jul 5 08:28 MProbe02.log
3、增量實時同步腳本:
[root@5b9dbaaa148a test_log]# cat logmachine.sh
#!/bin/bash
icnt=0;
while (true)
do
echo "[debug][20160703-15:00]"$icnt >> MProbe01.log
echo "[ERROR][20160704-17:00]"$icnt >> MProbe02.log
icnt=$((icnt+1));
done
4、logstash配置檔案:
[root@5b9dbaaa148a logstash_jdbc_test]# cat log_test.conf
input {
file {
path=> [ "/usr/local/logstash/bin/test_log/MProbe01.log",
"/usr/local/logstash/bin/test_log/MProbe02.log" ]
#codec=>multiline {
# pattern => "^\s"
# what=>"previous"
#}
type=>"probe_log" #類型名稱
# tags=>["XX.XX.XX.XX"]
}
}
###過濾
#filter{
# grok {
# match => ["message","mailmonitor"]
# add_tag => [mailmonitor]
# }
# grok {
# match => [ "message", "smsmonitor" ]
# add_tag => [smsmonitor]
# }
# ....
#}
###output to es
output {
elasticsearch {
hosts => "10.8.5.101:9200"
index => "mprobe_index" #索引名稱
#template_name => "mprobelog"
#document_id => "%{id}"
}
stdout { codec => json_lines }
}
5、同步測試:
[root@5b9dbaaa148a bin]# ./logstash -f ./logstash_jdbc_test/log_test.conf
Settings: Default pipeline workers: 24
Pipeline main started
{"message":"[DEbug][20160305-15:35]testing02","@version":"1","@timestamp":"2016-07-05T07:26:08.043Z","path":"/usr/local/logstash/bin/test_log/MProbe01.log","host":"5b9dbaaa148a"
6、結果驗證
(1)日志記錄:
[root@5b9dbaaa148a test_log]# tail -f MProbe01.log
[DEbug][20160305-15:35]testing02
[DEbug][20160305-15:35]testing01
^C
[root@5b9dbaaa148a test_log]# tail -f MProbe02.log
[DEbug][20160305-15:35]testing02_001
[DEbug][20160305-15:35]testing02_003
(2)ES記錄
作者:銘毅天下
轉載請标明出處,原文位址:
http://blog.csdn.net/laoyang360/article/details/51842744