更改filebast

filebast/us-prod-01/filebeat.yml

@@ -18,11 +18,11 @@ processors:
       when:
         equals:
           log_type: admin.log 
-      tokenizer: '%{timestamp} [%{thread}] %{log_level} %{log_message}'
+      tokenizer: '%{timestamp} %{level} %{pid} --- \\[%{thread}\\] %{class} : %{message}'
       field: "message"
-      target_prefix: "parsed_sys_info"
+      target_prefix: "mylog"
       ignore_missing: true
-      overwrite_keys: false
+      overwrite_keys: true
 
 
 

filebast/us-prod-01/flymoon-admin.yml

@@ -2,14 +2,14 @@
   id: us_pord_01_flymoon-admin
   enabled: true
   paths:
-    - /root/logs/flymoon-admin/sys-info.log
+    - /root/logs/flymoon-admin/app.log
   fields:
     application: flymoon-admin  # 自定义字段，标识应用名称
     log_type: admin.log  # 自定义字段，标识日志类型
     environment: us-pord    # 自定义字段，标识机器环境名称
     instance: us-prod-01  # 自定义字段，标识机器名称
   fields_under_root: true
-  multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对info的日志格式
+  multiline.pattern: '^\d{4}-\d{2}-\d{2}\ \d{2}:\d{2}:\d{2}\.\d{3}'
   multiline.negate: true
   multiline.match: after
   ignore_older: 24h   # 忽略旧日志文件（避免处理已归档的日志）

filebast/us-prod-02/filebeat.yml

@@ -27,7 +27,7 @@ processors:
       when:
         equals:
           log_type: email.log
-      tokenizer: '%{timestamp} [%{thread}] %{level} %{class} - [%{method_line}] - %{message}'
+      tokenizer: '%{timestamp} %{level} %{pid} --- \\[%{thread}\\] %{message}'
       field: "message"
       target_prefix: "mylog"
       ignore_missing: true
@@ -37,7 +37,7 @@ processors:
       when:
         equals:
           log_type: agent.log
-      tokenizer: '%{timestamp} %{level} - [%{method},%{line}] - %{message}'
+      tokenizer: '%{date} %{time} %{level}  %{pid} --- [%{thread}] %{class->} : [%{app}] %{message}'
       field: "message"
       target_prefix: "mylog"
       ignore_missing: true
@@ -45,6 +45,7 @@ processors:
 
 
 
+
 #输出
 output.elasticsearch:
   hosts: ["http://106.53.194.199:9200"]

filebast/us-prod-02/flymoon-agent.yml

@@ -9,7 +9,7 @@
     environment: us-pord    # 自定义字段，标识机器环境名称
     instance: us-prod-02  # 自定义字段，标识机器名称
   fields_under_root: true
-  multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对email的sys-info.log的日志格式多行
+  multiline.pattern: '^\d{4}-\d{2}-\d{2}\ \d{2}:\d{2}:\d{2}\.\d{3}'
   multiline.negate: true
   multiline.match: after
   ignore_older: 24h   # 忽略旧日志文件（避免处理已归档的日志）

filebast/us-prod-02/flymoon-email.yml

@@ -20,4 +20,3 @@
   start_position: beginning   # 从文件的开头读取
  
 
- 

filebast/us-prod-03/filebeat.yml

@@ -25,18 +25,20 @@ processors:
   - dissect:
       when:
         equals:
-          log_type: payment.log
-      tokenizer: '%{timestamp} [%{thread}] %{level} %{class} - [%{method},%{line}] - %{message}'
+          log_type: agent.log
+      tokenizer: '%{date} %{time} %{level}  %{pid} --- [%{thread}] %{class->} : [%{app}] %{message}'
       field: "message"
       target_prefix: "mylog"
       ignore_missing: true
       overwrite_keys: true
 
+
+
   - dissect:
       when:
         equals:
-          log_type: agent.log
-      tokenizer: '%{timestamp} %{level} - [%{method},%{line}] - %{message}'
+          log_type: payment.log
+      tokenizer: '%{date} %{time} %{level}  %{pid} --- [%{thread}] %{class->} : [%{app}] %{message}'
       field: "message"
       target_prefix: "mylog"
       ignore_missing: true
@@ -44,6 +46,7 @@ processors:
 
 
 
+
 #输出
 output.elasticsearch:
   hosts: ["http://106.53.194.199:9200"]

filebast/us-prod-03/flymoon-agent.yml

@@ -9,7 +9,7 @@
     environment: us-pord    # 自定义字段，标识机器环境名称
     instance: us-prod-03  # 自定义字段，标识机器名称
   fields_under_root: true
-  multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对email的sys-info.log的日志格式多行
+  multiline.pattern: '^\d{4}-\d{2}-\d{2}\ \d{2}:\d{2}:\d{2}\.\d{3}'
   multiline.negate: true
   multiline.match: after
   ignore_older: 24h   # 忽略旧日志文件（避免处理已归档的日志）

filebast/us-prod-03/flymoon-payment.yml

@@ -2,14 +2,14 @@
   id: us_pord_03_flymoon-payment
   enabled: true
   paths:
-    - /root/logs/flymoon-payment/sys-info.log
+    - /root/logs/flymoon-payment/app.log
   fields:
     application: flymoon-payment
     log_type: payment.log
     environment: us-pord
     instance: us-prod-03
   fields_under_root: true
-  multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}'
+  multiline.pattern: '^\d{4}-\d{2}-\d{2}\ \d{2}:\d{2}:\d{2}\.\d{3}'
   multiline.negate: true
   multiline.match: after
   ignore_older: 24h   # 忽略旧日志文件（避免处理已归档的日志）