logstash的功能有一点是把 各种软件生成的各种格式的日志 转换成一个方便检索筛选的格式,本文演示了一个最简单的例子。
一 转换的效果 实例: rabbitmq-server 日志: =INFO REPORT==== 16-Jan-2017::09:27:09 ===
Mirrored queue 'heat-engine-listener.e9e416bb-6733-4981-bf00-bd64c104ccad' in vhost '/': Adding mirror on node 'rabbit@server-31': <0.2266.0> 转换后的格式为: { "year" => "2017",
"mounthday" => "16",
"logdata" => "Mirrored queue 'heat-engine-listener.e9e416bb-6733-4981-bf00-bd64c104ccad' in vhost '/': Adding mirror on node 'rabbit@server-31': <0.2266.0>",
"message" => "=INFO REPORT==== 16-Jan-2017::09:27:09 ===\nMirrored queue 'heat-engine-listener.e9e416bb-6733-4981-bf00-bd64c104ccad' in vhost '/': Adding mirror on node 'rabbit@server-31': <0.2266.0>",
"type" => "rabbit",
"tags" => [
[0] "multiline"
],
"path" => "/var/log/rabbitmq/rabbit@server-31.log",
"@timestamp" => 2017-01-16T01:27:09.718Z,
"loglevel" => "INFO",
"@version" => "1",
"host" => "server-31",
"time" => "09:27:09",
"mounth" => "Jan"
} 转换后的内容传入elasticsearch中,用户就可以按照时间、日志等级、主机等对汇总的日志进行筛选检索 二 转换的过程还是以刚才那条日志为例 =INFO REPORT==== 16-Jan-2017::09:27:09 ===
Mirrored queue 'reply_963a14cce15f48e786240aad41817847' in vhost '/': Adding mirror on node 'rabbit@server-31': <0.2262.0> =INFO REPORT==== 16-Jan-2017::09:27:09 ===
Mirrored queue 'heat-engine-listener.e9e416bb-6733-4981-bf00-bd64c104ccad' in vhost '/': Adding mirror on node 'rabbit@server-31': <0.2266.0> =INFO REPORT==== 16-Jan-2017::09:27:09 ===
Mirrored queue 'q-agent-notifier-network-update' in vhost '/': Adding mirror on node 'rabbit@server-31': <0.2270.0> 日志是多行,前后各有一行空行,日志行以=开头, 1、多行合并首先是合并多行, 安装多行插件: /usr/share/logstash/bin/logstash-plugin install logstash-filter-multiline 在配置文件中配置多行合并 codec => multiline { pattern => "^="
what => "previous"
negate => true
} 最终日志转换为 =INFO REPORT==== 16-Jan-2017::09:27:09 ===\nMirrored queue 'heat-engine-listener.e9e416bb-6733-4981-bf00-bd64c104ccad' in vhost '/': Adding mirror on node 'rabbit@server-31': <0.2266.0> 2、分析日志的格式和规律结合所有的rabbitmq的日志总结规律为 =“日志级别” REPORT==== "日期"::“时间” ===\n“日志内容” 注意不要忘记中间的空格 3、正则匹配logstash内置了很多常规正则,参见 https://github.com/elastic/logstash/blob/v1.4.2/patterns/grok-patterns 本文都是采用内置的正则 =INFO REPORT==== 16-Jan-2017::09:27:09 ===\nMirrored queue 'heat-engine-listener.e9e416bb-6733-4981-bf00-bd64c104ccad' in vhost '/': Adding mirror on node 'rabbit@server-31': <0.2266.0> 我最终的匹配的表达式为 ^=%{LOGLEVEL:loglevel} REPORT=+ %{MONTHDAY:mounthday}-%{MONTH:mounth}-%{YEAR:year}::%{TIME:time} ===\n%{GREEDYDATA:logdata}$
%{LOGLEVEL:loglevel}表示这是一个变量,里面的内容要匹配logstash内置的LOGLEVE正则,并且里面的内容和loglevel这个key形成一对kv值:"loglevel":"INFO" 其他一直类推 logstash提供了一个测试表达式的网址http://grokdebug.herokuapp.com/
|