Logstash-安装logstash-filter-multiline插件(解决logstash匹配多行日志)

ELK-logstash在搬运日志的时候会出现多行日志，普通的搬运会造成保存到ES中日志一条一条的保存，很丑，而且不方便读取，logstash-filter-multiline可以解决该问题。

接下来演示下问题：
普通日志如下：

-- ::41.375 [http-nio--exec-] ERROR c.h.h.control.**-自定义的msg

java.lang.ArithmeticException: / by zero

    at com.hikvision.hikserviceassign.control.ServiceMonitorManageController.reAssign(ServiceMonitorManageController.java:)

    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:)

    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:)

    at java.lang.reflect.Method.invoke(Method.java:)

    at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:)

.....省略

记录到es的记录则是：

-- ::41.375 [http-nio--exec-] ERROR c.h.h.control.**-自定义的msg

-- ::41.375 [http-nio--exec-]java.lang.ArithmeticException: / by zero

-- ::41.375 [http-nio--exec-]at com.hikvision.hikserviceassign.control.ServiceMonitorManageController.reAssign(ServiceMonitorManageController.java:)

-- ::41.375 [http-nio--exec-]at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

-- ::41.375 [http-nio--exec-]at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:)

-- ::41.375 [http-nio--exec-]at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:)

-- ::41.375 [http-nio--exec-]at java.lang.reflect.Method.invoke(Method.java:)

-- ::41.375 [http-nio--exec-]at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:)

.....省略

我们希望的结果肯定是这样的

接下来就是安装logstash-filter-multiline，进入logstash/bin目录下使用命令

$ ./logstash-plugin install logstash-filter-multiline

如果报错 certificate verify failed 则在install 后面加上 --no-verify

安装成功后，增加config，demo如下：

input {

    tcp {

        port =>

        codec => json

    }

} 

filter {

       multiline {

            pattern => "^\d{4}-\d{1,2}-\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}"

            negate => true

            what => "previous"

        }

} 

output {

    elasticsearch {

        hosts => "127.0.0.1:9200"

            index => "es-message-%{+YYYY.MM.dd}"

    }

    stdout { codec => rubydebug }

}

巴特西

Logstash-安装logstash-filter-multiline插件(解决logstash匹配多行日志)

最新文章

热门文章