logstash output配置：
output{
elasticsearch {
hosts => ['10.15.12.181:9200', '10.18.171.17:9200', '10.15.12.153:9200', '10.15.12.95:9200', '10.15.12.97:9200', '10.19.23.206:9200', '10.19.23.205:9200', '10.15.12.130:9200', '10.15.12.131:9200', '10.17.118.171:9200', '10.15.12.96:9200', '10.15.12.182:9200', '10.15.12.155:9200', '10.18.171.18:9200',"10.19.23.206:9200"]
index => "log-dui-rsyslog-audit-%{+YYYY.MM.dd}"
}
}
索引template
curl -H "Content-Type:application/json" -X PUT http://10.15.12.96:9200/_template/cleanning-log -d
'{"index_patterns":["cleanning-log-*"],"settings":{"index":{"number_of_shards":"5","number_of_replicas":"1","search.slowlog.threshold.query.warn":"10s","search.slowlog.threshold.query.info":"5s","search.slowlog.threshold.query.debug":"500ms","refresh_interval":"120s","blocks":{"read_only_allow_delete":"false"}}},"index.mapping.total_fields.limit":5000,"mappings":{"_default_":{"dynamic_templates":[{"message_field":{"path_match":"message","match_mapping_type":"string","mapping":{"type":"text","norms":false}}},{"string_fields":{"match":"*","match_mapping_type":"string","mapping":{"type":"text","norms":false,"fields":{"keyword":{"type":"keyword","ignore_above":256}}}}}],"properties":{"@timestamp":{"type":"date"},"message":{"properties":{"time":{"properties":{"kernel":{"properties":{"result":{"type":"float"},"start":{"type":"float"},"stop":{"type":"float"}}}}}}},"@version":{"type":"keyword"},"geoip":{"dynamic":true,"properties":{"ip":{"type":"ip"},"location":{"type":"geo_point"},"latitude":{"type":"half_float"},"longitude":{"type":"half_float"}}}}}}}'
格式化（json）template
{
"index_patterns": ["cleanning-log-*"],
"settings": {
"index": {
"number_of_shards": "5",
"number_of_replicas": "1",
"search.slowlog.threshold.query.warn": "10s",
"search.slowlog.threshold.query.info": "5s",
"search.slowlog.threshold.query.debug": "500ms",
"refresh_interval": "120s",
"blocks": {
"read_only_allow_delete": "false"
}
}
},
"index.mapping.total_fields.limit": 5000,
"mappings": {
"_default_": {
"dynamic_templates": [{
"message_field": {
"path_match": "message",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"norms": false
}
}
}, {
"string_fields": {
"match": "*",
"match_mapping_type": "string",
"mapping": {
"type": "text",
"norms": false,
"fields": {
"keyword": {
"type": "keyword",
"ignore_above": 256
}
}
}
}
}],
"properties": {
"@timestamp": {
"type": "date"
},
"message": {
"properties": {
"time": {
"properties": {
"kernel": {
"properties": {
"result": {
"type": "float"
},
"start": {
"type": "float"
},
"stop": {
"type": "float"
}
}
}
}
}
}
},
"@version": {
"type": "keyword"
},
"geoip": {
"dynamic": true,
"properties": {
"ip": {
"type": "ip"
},
"location": {
"type": "geo_point"
},
"latitude": {
"type": "half_float"
},
"longitude": {
"type": "half_float"
}
}
}
}
}
}
}