更改filebast

filebast/us-prod-03/filebeat.yml

@@ -25,18 +25,20 @@ processors:
   - dissect:
       when:
         equals:
-          log_type: payment.log
-      tokenizer: '%{timestamp} [%{thread}] %{level} %{class} - [%{method},%{line}] - %{message}'
+          log_type: agent.log
+      tokenizer: '%{date} %{time} %{level}  %{pid} --- [%{thread}] %{class->} : [%{app}] %{message}'
       field: "message"
       target_prefix: "mylog"
       ignore_missing: true
       overwrite_keys: true
 
+
+
   - dissect:
       when:
         equals:
-          log_type: agent.log
-      tokenizer: '%{timestamp} %{level} - [%{method},%{line}] - %{message}'
+          log_type: payment.log
+      tokenizer: '%{date} %{time} %{level}  %{pid} --- [%{thread}] %{class->} : [%{app}] %{message}'
       field: "message"
       target_prefix: "mylog"
       ignore_missing: true
@@ -44,6 +46,7 @@ processors:
 
 
 
+
 #输出
 output.elasticsearch:
   hosts: ["http://106.53.194.199:9200"]

filebast/us-prod-03/flymoon-agent.yml

@@ -9,7 +9,7 @@
     environment: us-pord    # 自定义字段，标识机器环境名称
     instance: us-prod-03  # 自定义字段，标识机器名称
   fields_under_root: true
-  multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}' # 针对email的sys-info.log的日志格式多行
+  multiline.pattern: '^\d{4}-\d{2}-\d{2}\ \d{2}:\d{2}:\d{2}\.\d{3}'
   multiline.negate: true
   multiline.match: after
   ignore_older: 24h   # 忽略旧日志文件（避免处理已归档的日志）

filebast/us-prod-03/flymoon-payment.yml

@@ -2,14 +2,14 @@
   id: us_pord_03_flymoon-payment
   enabled: true
   paths:
-    - /root/logs/flymoon-payment/sys-info.log
+    - /root/logs/flymoon-payment/app.log
   fields:
     application: flymoon-payment
     log_type: payment.log
     environment: us-pord
     instance: us-prod-03
   fields_under_root: true
-  multiline.pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}'
+  multiline.pattern: '^\d{4}-\d{2}-\d{2}\ \d{2}:\d{2}:\d{2}\.\d{3}'
   multiline.negate: true
   multiline.match: after
   ignore_older: 24h   # 忽略旧日志文件（避免处理已归档的日志）