elk之nginx
2024-09-28 22:43:59
elk之nginx: ignore_older => 86400，不处理一天以前的文件。 zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat logstash_agent.conf
input {
file {
type => "zj_nginx_access"
path => ["/rsyslog/data/nginx/zjzc/nginx_access0*_log.*"]
ignore_older => 87400
}
}
filter {
grok {
match => {
"message" => "%{IPORHOST:clientip} \[%{HTTPDATE:time}\] \"%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}\" %{NUMBER:http_status_code} %{NUMBER:bytes} \"(? <http_referer>\S+)\" \"(?<http_user_agent>\S+)\" \"(?<http_x_forwarded_for>\S+)\""
}
}
}
output {
redis {
host => "192.168.32.67"
data_type => "list"
key => "zj_nginx:redis"
port=>"6379"
password => "1234567"
}
} 启动logstash agent: [elk@zjtest7-frontend sbin]$ cd /usr/local/logstash-2.3.4/bin/
[elk@zjtest7-frontend bin]$ ./logstash -f ../config/logstash_agent.conf 设置权限: chown -R elk:elk /rsyslog 127.0.0.1:6379> keys *
1) "\xac\xed\x00\x05t\x00!message_left:20160630:18158464881"
2) "\xac\xed\x00\x05t\x00\x18contract_rebuild_qty:422"
3) "\xac\xed\x00\x05t\x00&oauth:c761feda1b6182c04864a54f8eee8344"
4) "\xac\xed\x00\x05t\x00Dapp_permission_cache:com.zjzc.common.vo.permission.AppPermissionBean"
5) "zj_nginx:redis"
6) "shiro_redis_session:42c9052e-9b60-4a1c-87a1-3aaa24a4369f"
7) "\xac\xed\x00\x05t\x003client_roles_cache:c761feda1b6182c04864a54f8eee8344"
8) "\xac\xed\x00\x05t\x00\x18contract_rebuild_qty:417"
9) "\xac\xed\x00\x05t\x00\x18contract_rebuild_qty:427"
10) "\xac\xed\x00\x05t\x00\x18contract_rebuild_qty:423" 127.0.0.1:6379> LLEN "zj_nginx:redis"
(integer) 4232
127.0.0.1:6379> zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat logstash_indexer.conf
input {
redis {
host => "192.168.32.67"
data_type => "list"
key => "zj_nginx:redis"
type => "redis-input"
password => "1234567"
port =>"6379"
}
}
output {
elasticsearch {
hosts => "192.168.32.80:9200"
index => "logstash-zjzc-nginx-%{+YYYY.MM.dd}"
}
stdout {
codec => rubydebug
}
}
最新文章
- OpenCASCADE Job - Shoe Doctor
- C#之委托与事件
- ZLL本地局域网通信过程
- [问题2015S10] 复旦高等代数 II（14级）每周一题（第十一教学周）
- ORACLE 常用函数 日期/时间函数
- Django--models连表构建
- NPOI Excel类
- Oracle12c创建新用户提示公共用户名或角色无效
- iOS中SQLite知识点总结2
- Android开发之ViewPager实现轮播图（轮播广告）效果的自定义View
- 异常处理与调试 - 零基础入门学习Delphi50
- Map 的遍历
- wordpress搭建后地址栏页面显示IP地址的问题
- mysql按ID排序（转）
- Android中在布局中写ViewPager无法渲染出来的问题
- iOS----------Mac维修预约-如何找到电脑维修单
- （转载）C#使用MemoryStream类读写内存
- Centos7安装Chacha20加密算法 (验证成功)
- php安装xmlwriter遇到报错及解决方法
- Ionic-wechat项目边开发边学（四）:可伸缩输入框,下拉刷新, 置顶删除