logstash 分析nginx 错误日志

[root@dr-mysql01 frontend-error]# cat logstash_error.conf 
input {
        file {
                type => "zj_frontend_error"
                path => ["/data01/applog_backup/zjzc_log/zj-frontend0*error*"]
        }
    
       file { 
                type => "wj_frontend_error" 
                path => ["/data01/applog_backup/winfae_log/wj-frontend0*error*"] 
        } 

 
}
filter {
        grok {
            match => [ "message" , "(?%{YEAR}[./-]%{MONTHNUM}[./-]%{MONTHDAY}[- ]%{TIME}) \[%{LOGLEVEL:severity}\] %{POSINT:pid}#%{NUMBER}: (?:, client: (?%{IP}|%{HOSTNAME}))(?:, server: %{IPORHOST:server}?)(?:, request: %{QS:request})?(?:, upstream: (?\"%{URI}\"|%{QS}))?(?:, host: %{QS:request_host})?(?:, referrer: \"%{URI:referrer}\")?"]
        }
}

output {
     if [type] == "zj_frontend_error" { 
        redis {
                host => "192.168.32.67"
                data_type => "list"
                key => "zj_frontend_error:redis"
                port=>"6379"
                password => "1234567"
        }
}
      else if [type] == "wj_frontend_error"{
       redis { 
                host => "192.168.32.67" 
                data_type => "list" 
                key => "wj_frontend_error:redis" 
                port=>"6379" 
                password => "1234567" 
        } 
}
}
  

  

You have mail in /var/spool/mail/root
[root@dr-mysql01 frontend-error]# cat logstash_indexer.conf 
input {
        redis {
                host => "192.168.32.67"
                data_type => "list"
                key => "zj_frontend_error:redis"
                password => "1234567"
                port =>"6379"
        }


        redis {
                host => "192.168.32.67"
                data_type => "list"
                key => "wj_frontend_error:redis"
                password => "1234567"
                port =>"6379"
        }


}
output {
      if   [type] == "zj_frontend_error"{ 
        elasticsearch {
                hosts => "192.168.32.80:9200"
                index => "logstash-zjzc-frontend-error-%{+YYYY.MM.dd}"
        }
		stdout {
			codec => rubydebug
		}
      }  
      else if  [type] == "wj_frontend_error"{
      elasticsearch {
                hosts => "192.168.32.81:9200"
                index => "logstash-wj-frontend-error-%{+YYYY.MM.dd}"
        }
                stdout {
                        codec => rubydebug
                } 
  
  }

}

转载于:https://www.cnblogs.com/zhaoyangjian724/p/6199317.html