Logstash配置

將json文件寫入ElasticSearch 配置文件 analysis.conf 以下

input {
    file {
        path => "/data/openresty/nginx/interfacelogs/*.log"
        start_position => beginning
        stat_interval => 1 #設置多長時間檢測文件是否修改 默認是1s
        #tags => "test" #添加標籤
        #設置多長時間掃描目錄，發現新文件
        discover_interval => 15 #單位s
    }
}

filter {
    json{
        source => "message"
    }
    mutate{
        remove_field => ["message"]    #移除message字段
        #add_field => {"test"=>"test"}
        convert =>[                   
          "request_time","float",             
          "upstream_response_time","float",                
          "status","integer"]       #指定字段類型 
    }
}
output {
     elasticsearch {
       action => "index"
       hosts => ["10.18.144.10:9200","10.18.10.209:9200"]
       index => "ls_%{+YYYYMM}_nginx_log"
       document_type => "ls_%{+YYYYMM}_nginx_log"
     }
     stdout {
       codec => json
     }

}

運行 /data/logstash-6.2.2/bin/logstash -f  /data/logstash-6.2.2/config/analysis.conf