elk7.7.1【系列八】logstash 根据不同 tags 配置 不同输出索引

1、修改filebeat配置文件

vim /etc/filebeat/filebeat.yml

 2、修改logstash配置文件

cd /etc/logstash/conf.d
vim file.conf

input {
    beats {
                port => 5044
        }
}

filter{
        if "tomcat8" in [tags]{
            grok{
                match => {"message" => "%{IP:ip_address}\ -\ -\ \[%{HTTPDATE:timestamp}\]\ %{QS:referrer}\ %{NUMBER:status}\ %{NUMBER:bytes}"}
            }
            date{
                match => ["timestamp","dd/MMM/yyyy:HH:mm:ss Z"]
            }
            mutate{
                remove_field => ["message"]
            }
    }
}
output {
    if "tomcat7" in [tags]{
        elasticsearch {
            hosts => ["http://192.168.81.129:9200"]
            index => "tomcat7-logstash-%{+yyyy.MM.dd}"
        }
    }
    if "tomcat8" in [tags]{
        elasticsearch {
            hosts => ["http://192.168.81.129:9200"]
            index => "tomcat8-logstash-%{+yyyy.MM.dd}"
        }
    }
}

3、kibana中查看