Logstach配置文件详解

67543

配置文件的基本格式，输入部分，过滤器部分和输出部分。

1 2 3 4 5 6 7 8 9 10 11

# This is a comment. You should use comments to describe # parts of your configuration. input {   ... } filter {   ... } output {   ... }

每个部分都可以配置一个或多个插件。下面展示的是输入部分，有两个file插件。

1 2 3 4 5 6 7 8 9 10

input {   file {     path => "/var/log/messages"     type => "syslog"   }   file {     path => "/var/log/apache/access.log"     type => "apache"   } }

插件的值类型
数组

1 2	path => [ "/var/log/messages", "/var/log/*.log" ] path => "/data/mysql/mysql.log"

  布尔

1	ssl_enable => true

字符串

1 2	name => "Hello world" name => 'It\'s a beautiful day'

哈希

1 2 3 4 5

match => {   "field1" => "value1"   "field2" => "value2"   ... }

  字节

1 2 3 4

my_bytes => "1113"   # 1113 bytes   my_bytes => "10MiB"  # 10485760 bytes   my_bytes => "100kib" # 102400 bytes   my_bytes => "180 mb" # 180000000 bytes

代码

1	codec => "json"

数值：浮点或整型

1	port => 33

密码型：不会记录到日志或打印出来

1	my_password => "password"

  路径型：字符串

1	my_path => "/tmp/logstash"

注释：使用#