1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
|
input {
file {
path => ["/tmp/xixi.log"]
start_position => "beginning"
type => "xixi"
}
beats {
port => 9999
type => "haha"
}
tcp {
port => 8888
type => "hehe"
}
}
filter {
# 如果类型是"xixi"，则遵循if语句代码块的处理逻辑。
if [type] == "xixi" {
grok {
match => {
message => "%{HTTPD_COMMONLOG}"
}
}
geoip {
source => "clientip"
# 不写 database 插件会自己去下载 mmdb，且每次新 path.data 都要重下
database => "/etc/logstash/GeoLite2-City.mmdb"
}
useragent {
source => "message"
target => "dawn-device"
}
date {
match => ["timestamp","dd/MMM/yyyy:HH:mm:ss Z"]
}
mutate {
remove_field => [ "ecs","agent","tags","input","@version","log","host" ]
}
} else if [type] == "haha" {
mutate {
remove_field => [ "ecs","agent","tags","input","@version","log", "host"]
}
} else {
grok {
patterns_dir => ["/etc/logstash/dawn-patterns/"]
match => {
message => "%{SCHOOL:dawn-school} haha %{CLAss:dawn-class} xixi %{year:dawn-year} %{IPV4:dawn-ip}"
}
tag_on_failure => ["_grokparsefailure"]
}
mutate {
remove_field => [ "ecs","agent","tags","input","@version","log","host" ]
}
}
}
output {
stdout {}
if [type] == "xixi" {
elasticsearch {
hosts => ["http://11.0.1.111:9200","http://11.0.1.112:9200","http://11.0.1.113:9200"]
index => "dawn-logstash-if-xixi-%{+yyyy.MM.dd}"
}
} else if [type] == "haha" {
elasticsearch {
hosts => ["http://11.0.1.111:9200","http://11.0.1.112:9200","http://11.0.1.113:9200"]
index => "dawn-logstash-if-haha-%{+yyyy.MM.dd}"
}
}else {
elasticsearch {
hosts => ["http://11.0.1.111:9200","http://11.0.1.112:9200","http://11.0.1.113:9200"]
index => "dawn-logstash-if-hehe-%{+yyyy.MM.dd}"
}
}
}
|