logstash发邮件
1、合并日志
这个filter的功能顾名思义就是对多行的日志进行处理 这个是官网上的说明
multiline filter
This filter will collapse multiline messages into a single event.
The multiline filter is for combining multiple events from a single source into the same event.
下面看下格式
这个 negate 有两种 true 或者 false，默认是 true,如果选了false 的话估计就是取反的意思。
看看例子
php的错误日志中常常会出现这样的日志
[03-Jun-2013 13:15:29] PHP Fatal error: Uncaught exception 'Leb_Exception' in /data1/www/bbs.xman.com/htdocs/framework/xbox/ufo.php:68
Stack trace:
#0 /data/www/bbs.xman.com/htdocs/framework/dao/abstract.php(299): Leb_Dao_Pdo->connect(Array, 'read')
#1 /data/www/bbs.xman.com/htdocs/framework/dao/pdo.php(108): Leb_Dao_Abstract->initConnect(false)
#2 /data/www/bbs.xman.com/htdocs/framework/dao/abstract.php(1123): Leb_Dao_Pdo->query('SELECT * FROM `...')
#3 /data/www/bbs.xman.com/htdocs/framework/dao/abstract.php(1217): Leb_Dao_Abstract->select(Array)
#4 /data/www/bbs.xman.com/htdocs/framework/model.php(735): Leb_Dao_Abstract->daoSelect(Array, false)
#5 /data/www/bbs.xman.com/htdocs/app/configure/model/configure.php(40): Leb_Model->find()
#6 /data/www/bbs.xman.com/htdocs/app/search/default.php(131): Configure->get_configure_by_type('news')
#7 /data/www/bbs.xman.com/htdocs/framework/dispatcher.php(291): defaultController->indexAction()
#8 /data/www/bbs.xman.com/htdocs/framework/dispatcher.php(222): Leb_Di in /data1/www/bbs.xman.com/htdocs/framework/dao/pdo.php on line 68这个filter的功能顾名思义就是对多行的日志进行处理 这个是官网上的说明
multiline filter
This filter will collapse multiline messages into a single event.
The multiline filter is for combining multiple events from a single source into the same event.
下面看下格式
filter {
multiline {
type => "type" #类型,不多说
pattern => "pattern, a regexp" #参数,也可以认为是字符,有点像grep ,如果符合什么字符就交给下面的 what 去处理
negate => boolean
what => "previous" or "next" #这个是符合上面 pattern 的要求后具体怎么处理,处理方法有两种,合并到上面一条日志或者下面的日志
}
}这个 negate 有两种 true 或者 false，默认是 true,如果选了false 的话估计就是取反的意思。
看看例子
filter {
multiline {
pattern => "^[^\[]"
what => "previous"
}
}output {
email {
match => [ "@message", "aaaaa" ]
to => "[email protected]"
from => "[email protected]"
options => [ "smtpIporHost", "smtp.mibnet.com",
"port", "25",
"userName", "[email protected]",
"starttls", "true",
"password", "opmonitor",
"authenticationType", "login"
]
subject => "123"
body => '123'
via => smtp
}
}
filter {
grep {
match => [ "@message", "PHP Fatal error" ]
drop => false
add_tag => [fatal_error]
}
grep {
tags => [fatal_error]
match => [ "@message", ".*(xbox\.com|xbox\.mib\.com\.cn|supports\.game\.mib\.com\.cn)" ]
drop => false
add_tag => [xboxerror]
}
}
output {
exec {
tags => [xboxerror]
command => "echo '%{@timestamp} %{@source}: %{@message}' | mail -s xbox_phplog_error_message [email protected]"
}
}mutate {
type => "phplog"
gsub => [ "@message","'", "\"" ]
}