更改
This commit is contained in:
dxin
@@ -1,7 +1,7 @@
|
||||
setup.template.name: "lessie-sit"
|
||||
setup.template.pattern: "lessie-sit*"
|
||||
setup.template.enabled: true
|
||||
setup.ilm.enabled: true
|
||||
setup.template.name: "sit-flymoonlog"
|
||||
setup.template.pattern: "sit-flymoonlog*"
|
||||
|
||||
|
||||
|
||||
@@ -19,33 +19,42 @@ processors:
|
||||
- dissect:
|
||||
when:
|
||||
equals:
|
||||
log_type: sys-info
|
||||
tokenizer: '%{timestamp} [%{thread}] %{log_level} %{class_name} - [%{method},%{line}] - %{message}'
|
||||
log_type: admin.log
|
||||
tokenizer: '%{timestamp} [%{thread}] %{log_level} %{log_message}'
|
||||
field: "message"
|
||||
target_prefix: "parsed_sys_info"
|
||||
# - include_fields:
|
||||
# fields: ["@timestamp", "log_type", "message", "application", "host.ip", "host.name", "log.file.path", "parsed_sys_info.timestamp", "parsed_sys_info.log_level", "parsed_sys_info.message", "parsed_sys_info.method", "parsed_sys_info.thread", "_id", "_index" ]
|
||||
ignore_missing: true
|
||||
overwrite_keys: false
|
||||
|
||||
- dissect:
|
||||
when:
|
||||
equals:
|
||||
log_type: sys-error
|
||||
tokenizer: '%{timestamp} [%{thread}] %{log_level} %{logger} - [%{method},%{line}] - %{message}'
|
||||
log_type: email.log
|
||||
tokenizer: '%{timestamp} [%{thread}] %{level} %{class} - [%{method_line}] - %{message}'
|
||||
field: "message"
|
||||
target_prefix: "parsed_sys_error"
|
||||
# - include_fields:
|
||||
# fields: ["@timestamp", "log_type", "message", "application", "host.ip", "host.name", "log.file.path", "parsed_sys_info.timestamp", "parsed_sys_info.log_level", "parsed_sys_info.message", "parsed_sys_info.method", "parsed_sys_info.thread", "_id", "_index", "parsed_sys_info.logger" ]
|
||||
target_prefix: "mylog"
|
||||
ignore_missing: true
|
||||
overwrite_keys: true
|
||||
|
||||
- dissect:
|
||||
when:
|
||||
equals:
|
||||
log_type: sys-user
|
||||
tokenizer: '%{timestamp} [%{thread}] %{log_level} %{module} - [%{method},%{line}] - %{message}'
|
||||
log_type: agent.log
|
||||
tokenizer: '%{timestamp} %{level} - [%{method},%{line}] - %{message}'
|
||||
field: "message"
|
||||
target_prefix: "parsed_sys_user"
|
||||
# - include_fields:
|
||||
# fields: ["@timestamp", "log_type", "message", "application", "host.ip", "host.name", "log.file.path", "parsed_sys_info.timestamp", "parsed_sys_info.log_level", "parsed_sys_info.message", "parsed_sys_info.method", "parsed_sys_info.thread", "_id", "_index", "parsed_sys_info.module" ]
|
||||
target_prefix: "mylog"
|
||||
ignore_missing: true
|
||||
overwrite_keys: true
|
||||
|
||||
- dissect:
|
||||
when:
|
||||
equals:
|
||||
log_type: payment.log
|
||||
tokenizer: '%{timestamp} [%{thread}] %{level} %{class} - [%{method},%{line}] - %{message}'
|
||||
field: "message"
|
||||
target_prefix: "mylog"
|
||||
ignore_missing: true
|
||||
overwrite_keys: true
|
||||
|
||||
|
||||
#输出
|
||||
@@ -53,7 +62,7 @@ output.elasticsearch:
|
||||
hosts: ["http://192.168.60.21:9200"]
|
||||
username: "admin"
|
||||
password: "123456"
|
||||
index: "sit-flymoonlog-%{[environment]}-%{[application]}-%{+yyyy.MM}" # 按月分割索引
|
||||
index: "%{[environment]}-%{[application]}-%{+yyyy.MM.dd}" # 按天分割索引
|
||||
bulk_max_size: 50 # 单批次传输最大文档数
|
||||
worker: 1 # 并行工作线程数
|
||||
timeout: 15s
|
||||
|
||||
@@ -1,14 +1,15 @@
|
||||
- type: log
|
||||
id: pord01_fly-moon-agent
|
||||
id: sit_flymoon-payment
|
||||
enabled: true
|
||||
paths:
|
||||
- /root/logs/flymoon-agent/sys-info.log
|
||||
- /root/logs/flymoon-payment/sys-info.log
|
||||
fields:
|
||||
application: flymoon-agent # 自定义字段，标识应用名称
|
||||
log_type: sys-info # 自定义字段，标识日志类型
|
||||
environment: pord01 # 自定义字段，标识机器环境名称
|
||||
application: flymoon-payment
|
||||
log_type: payment.log
|
||||
environment: sit
|
||||
instance: sit-server
|
||||
fields_under_root: true
|
||||
multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对email的sys-info.log的日志格式多行
|
||||
multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}'
|
||||
multiline.negate: true
|
||||
multiline.match: after
|
||||
ignore_older: 24h # 忽略旧日志文件（避免处理已归档的日志）
|
||||
@@ -17,6 +18,4 @@
|
||||
close_inactive: 5m # 文件超过5分钟无更新则关闭
|
||||
close_renamed: true # 处理被重命名的文件
|
||||
start_position: beginning # 从文件的开头读取
|
||||
|
||||
|
||||
|
||||
@@ -1,12 +1,13 @@
|
||||
- type: filestream
|
||||
id: input_sit_flymoon-admin_sys-info
|
||||
- type: log
|
||||
id: sit_flymoon-admin
|
||||
enabled: true
|
||||
paths:
|
||||
- /root/logs/flymoon-admin/sys-info.log
|
||||
fields:
|
||||
application: flymoon-admin # 自定义字段，标识应用名称
|
||||
log_type: sys-info # 自定义字段，标识日志类型
|
||||
log_type: admin.log # 自定义字段，标识日志类型
|
||||
environment: sit # 自定义字段，标识机器环境名称
|
||||
instance: sit-server # 自定义字段，标识机器名称
|
||||
fields_under_root: true
|
||||
multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对info的日志格式
|
||||
multiline.negate: true
|
||||
@@ -16,57 +17,4 @@
|
||||
clean_inactive: 25h # 清除超过一天未更新的文件
|
||||
close_inactive: 5m # 文件超过5分钟无更新则关闭
|
||||
close_renamed: true # 处理被重命名的文件
|
||||
start_position: beginning # 从文件的开头读取
|
||||
|
||||
# - type: filestream
|
||||
# id: input_sit_flymoon-admin_sys-error
|
||||
# enabled: true
|
||||
# paths:
|
||||
# - /root/logs/flymoon-admin/sys-error.log
|
||||
# fields:
|
||||
# application: flymoon-admin # 自定义字段，标识应用名称
|
||||
# log_type: sys-error # 自定义字段，标识日志类型
|
||||
# environment: sit # 自定义字段，标识机器环境名称
|
||||
# fields_under_root: true
|
||||
# multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对error的日志格式
|
||||
# multiline.negate: true
|
||||
# multiline.match: after
|
||||
# ignore_older: 24h # 忽略旧日志文件（避免处理已归档的日志）
|
||||
# scan_frequency: 10s # 定期扫描新文件的频率
|
||||
# clean_inactive: 25h # 清除超过一天未更新的文件
|
||||
# close_inactive: 5m # 文件超过5分钟无更新则关闭
|
||||
# close_renamed: true # 处理被重命名的文件
|
||||
# start_position: beginning # 从文件的开头读取
|
||||
|
||||
# - type: filestream
|
||||
# id: input_sit_flymoon-admin_sys-user
|
||||
# enabled: true
|
||||
# paths:
|
||||
# - /root/logs/flymoon-admin/sys-user.log
|
||||
# fields:
|
||||
# application: flymoon-admin # 自定义字段，标识应用名称
|
||||
# log_type: sys-user # 自定义字段，标识日志类型
|
||||
# environment: sit # 自定义字段，标识机器环境名称
|
||||
# fields_under_root: true
|
||||
# multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对user的日志格式
|
||||
# multiline.negate: true
|
||||
# multiline.match: after
|
||||
# ignore_older: 24h # 忽略旧日志文件（避免处理已归档的日志）
|
||||
# scan_frequency: 10s # 定期扫描新文件的频率
|
||||
# clean_inactive: 25h # 清除超过一天未更新的文件
|
||||
# close_inactive: 5m # 文件超过5分钟无更新则关闭
|
||||
# close_renamed: true # 处理被重命名的文件
|
||||
# start_position: beginning # 从文件的开头读取
|
||||
|
||||
|
||||
|
||||
|
||||
#设置索引模版
|
||||
# setup.template.name: "sit-flymoon-admin"
|
||||
# setup.template.pattern: "sit-flymoon-admin*"
|
||||
|
||||
# output.elasticsearch:
|
||||
# hosts: ["http://192.168.60.21:9200"]
|
||||
# username: "admin"
|
||||
# password: "123456"
|
||||
# index: "sit-flymoon-admin-%{+yyyy.MM}" # 按月分割索引
|
||||
start_position: beginning # 从文件的开头读取
|
||||
23
filebast/sit/flymoon-agent.yml
Normal file
23
filebast/sit/flymoon-agent.yml
Normal file
@@ -0,0 +1,23 @@
|
||||
- type: log
|
||||
id: sit_flymoon-agent
|
||||
enabled: true
|
||||
paths:
|
||||
- /root/logs/flymoon-agent/sys-info.log
|
||||
fields:
|
||||
application: flymoon-agent # 自定义字段，标识应用名称
|
||||
log_type: agent.log # 自定义字段，标识日志类型
|
||||
environment: sit # 自定义字段，标识机器环境名称
|
||||
instance: sit-server # 自定义字段，标识机器名称
|
||||
fields_under_root: true
|
||||
multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对email的sys-info.log的日志格式多行
|
||||
multiline.negate: true
|
||||
multiline.match: after
|
||||
ignore_older: 24h # 忽略旧日志文件（避免处理已归档的日志）
|
||||
scan_frequency: 10s # 定期扫描新文件的频率
|
||||
clean_inactive: 25h # 清除超过一天未更新的文件
|
||||
close_inactive: 5m # 文件超过5分钟无更新则关闭
|
||||
close_renamed: true # 处理被重命名的文件
|
||||
start_position: beginning # 从文件的开头读取
|
||||
|
||||
|
||||
|
||||
@@ -1,72 +0,0 @@
|
||||
- type: filestream
|
||||
id: input_sit_flymoon-partner_sys-info
|
||||
enabled: true
|
||||
paths:
|
||||
- /root/logs/flymoon-partner/sys-info.log
|
||||
fields:
|
||||
application: flymoon-partner # 自定义字段，标识应用名称
|
||||
log_type: sys-info # 自定义字段，标识日志类型
|
||||
environment: sit # 自定义字段，标识机器环境名称
|
||||
fields_under_root: true
|
||||
multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对info的日志格式多行
|
||||
multiline.negate: true
|
||||
multiline.match: after
|
||||
ignore_older: 24h # 忽略旧日志文件（避免处理已归档的日志）
|
||||
scan_frequency: 10s # 定期扫描新文件的频率
|
||||
clean_inactive: 25h # 清除超过一天未更新的文件
|
||||
close_inactive: 5m # 文件超过5分钟无更新则关闭
|
||||
close_renamed: true # 处理被重命名的文件
|
||||
start_position: beginning # 从文件的开头读取
|
||||
|
||||
# - type: filestream
|
||||
# id: input_sit_flymoon-admin_sys-error
|
||||
# enabled: true
|
||||
# paths:
|
||||
# - /root/logs/flymoon-admin/sys-error.log
|
||||
# fields:
|
||||
# application: flymoon-admin # 自定义字段，标识应用名称
|
||||
# log_type: sys-error # 自定义字段，标识日志类型
|
||||
# environment: sit # 自定义字段，标识机器环境名称
|
||||
# fields_under_root: true
|
||||
# multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对error的日志格式
|
||||
# multiline.negate: true
|
||||
# multiline.match: after
|
||||
# ignore_older: 24h # 忽略旧日志文件（避免处理已归档的日志）
|
||||
# scan_frequency: 10s # 定期扫描新文件的频率
|
||||
# clean_inactive: 25h # 清除超过一天未更新的文件
|
||||
# close_inactive: 5m # 文件超过5分钟无更新则关闭
|
||||
# close_renamed: true # 处理被重命名的文件
|
||||
# start_position: beginning # 从文件的开头读取
|
||||
|
||||
# - type: filestream
|
||||
# id: input_sit_flymoon-admin_sys-user
|
||||
# enabled: true
|
||||
# paths:
|
||||
# - /root/logs/flymoon-admin/sys-user.log
|
||||
# fields:
|
||||
# application: flymoon-admin # 自定义字段，标识应用名称
|
||||
# log_type: sys-user # 自定义字段，标识日志类型
|
||||
# environment: sit # 自定义字段，标识机器环境名称
|
||||
# fields_under_root: true
|
||||
# multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对user的日志格式
|
||||
# multiline.negate: true
|
||||
# multiline.match: after
|
||||
# ignore_older: 24h # 忽略旧日志文件（避免处理已归档的日志）
|
||||
# scan_frequency: 10s # 定期扫描新文件的频率
|
||||
# clean_inactive: 25h # 清除超过一天未更新的文件
|
||||
# close_inactive: 5m # 文件超过5分钟无更新则关闭
|
||||
# close_renamed: true # 处理被重命名的文件
|
||||
# start_position: beginning # 从文件的开头读取
|
||||
|
||||
|
||||
|
||||
|
||||
#设置索引模版
|
||||
# setup.template.name: "sit-flymoon-admin"
|
||||
# setup.template.pattern: "sit-flymoon-admin*"
|
||||
|
||||
# output.elasticsearch:
|
||||
# hosts: ["http://192.168.60.21:9200"]
|
||||
# username: "admin"
|
||||
# password: "123456"
|
||||
# index: "sit-flymoon-admin-%{+yyyy.MM}" # 按月分割索引
|
||||
@@ -1,72 +0,0 @@
|
||||
- type: filestream
|
||||
id: input_sit_flymoon-task_sys-info
|
||||
enabled: true
|
||||
paths:
|
||||
- /root/logs/flymoon-task/sys-info.log
|
||||
fields:
|
||||
application: flymoon-task # 自定义字段，标识应用名称
|
||||
log_type: sys-info # 自定义字段，标识日志类型
|
||||
environment: sit # 自定义字段，标识机器环境名称
|
||||
fields_under_root: true
|
||||
multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对info的日志格式多行
|
||||
multiline.negate: true
|
||||
multiline.match: after
|
||||
ignore_older: 24h # 忽略旧日志文件（避免处理已归档的日志）
|
||||
scan_frequency: 10s # 定期扫描新文件的频率
|
||||
clean_inactive: 25h # 清除超过一天未更新的文件
|
||||
close_inactive: 5m # 文件超过5分钟无更新则关闭
|
||||
close_renamed: true # 处理被重命名的文件
|
||||
start_position: beginning # 从文件的开头读取
|
||||
|
||||
# - type: filestream
|
||||
# id: input_sit_flymoon-admin_sys-error
|
||||
# enabled: true
|
||||
# paths:
|
||||
# - /root/logs/flymoon-admin/sys-error.log
|
||||
# fields:
|
||||
# application: flymoon-admin # 自定义字段，标识应用名称
|
||||
# log_type: sys-error # 自定义字段，标识日志类型
|
||||
# environment: sit # 自定义字段，标识机器环境名称
|
||||
# fields_under_root: true
|
||||
# multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对error的日志格式
|
||||
# multiline.negate: true
|
||||
# multiline.match: after
|
||||
# ignore_older: 24h # 忽略旧日志文件（避免处理已归档的日志）
|
||||
# scan_frequency: 10s # 定期扫描新文件的频率
|
||||
# clean_inactive: 25h # 清除超过一天未更新的文件
|
||||
# close_inactive: 5m # 文件超过5分钟无更新则关闭
|
||||
# close_renamed: true # 处理被重命名的文件
|
||||
# start_position: beginning # 从文件的开头读取
|
||||
|
||||
# - type: filestream
|
||||
# id: input_sit_flymoon-admin_sys-user
|
||||
# enabled: true
|
||||
# paths:
|
||||
# - /root/logs/flymoon-admin/sys-user.log
|
||||
# fields:
|
||||
# application: flymoon-admin # 自定义字段，标识应用名称
|
||||
# log_type: sys-user # 自定义字段，标识日志类型
|
||||
# environment: sit # 自定义字段，标识机器环境名称
|
||||
# fields_under_root: true
|
||||
# multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对user的日志格式
|
||||
# multiline.negate: true
|
||||
# multiline.match: after
|
||||
# ignore_older: 24h # 忽略旧日志文件（避免处理已归档的日志）
|
||||
# scan_frequency: 10s # 定期扫描新文件的频率
|
||||
# clean_inactive: 25h # 清除超过一天未更新的文件
|
||||
# close_inactive: 5m # 文件超过5分钟无更新则关闭
|
||||
# close_renamed: true # 处理被重命名的文件
|
||||
# start_position: beginning # 从文件的开头读取
|
||||
|
||||
|
||||
|
||||
|
||||
#设置索引模版
|
||||
# setup.template.name: "sit-flymoon-admin"
|
||||
# setup.template.pattern: "sit-flymoon-admin*"
|
||||
|
||||
# output.elasticsearch:
|
||||
# hosts: ["http://192.168.60.21:9200"]
|
||||
# username: "admin"
|
||||
# password: "123456"
|
||||
# index: "sit-flymoon-admin-%{+yyyy.MM}" # 按月分割索引
|
||||
Reference in New Issue
Block a user