說明：收集多個java程式的日誌，並輸出到es中。

編輯logstash的conf檔案

vim log.conf

配置檔案內容如下：

input {

        file {
                start_position => end ### 讀檔案的位子
                path => "/root/projects/fp-api/log/fp-api.log"
                type => "type1" ### 用去輸出到es時判斷存入哪個索引
                codec => multiline {
                        negate => true ### 是否匹配到
                        pattern => "(?<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3})  INFO %{NUMBER:thread} --- %{SYSLOG5424SD:task} %{JAVACLASS}\s*: %{SYSLOG5424SD:module}\s*%{GREEDYDATA:msg}" ### 匹配的正則
                        what => "previous" ###將沒匹配到的合併到上一條，可選previous或next, previous是合併到匹配的上一行末尾
                        max_lines => 1000 ### 最大允許的行
                        max_bytes => "10MiB" ### 允許的大小
                        auto_flush_interval => 30 ### 如果在規定時候內沒有新的日誌事件就不等待後面的日誌事件
               }
        }


        file {
​                start_position => end
​                path => "/root/projects/fp-acq/log/fp-acq.log"
​                type => "type2"
​                codec => multiline {
​                        pattern => "(?<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3})  INFO %{NUMBER:thread} --- %{SYSLOG5424SD:task} %{JAVACLASS}\s*: %{SYSLOG5424SD:module}\s*%{GREEDYDATA:msg}"
​                        negate => true
​                        what => "previous"
​                }
​        }

}


filter{
        grok{
                match => {
                        "message" => "(?<datetime>\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}.\d{3})  INFO %{NUMBER:thread} --- %{SYSLOG5424SD:task} %{JAVACLASS:javaclass}\s*: %{SYSLOG5424SD:module}\s*%{GREEDYDATA:msg}"
                 }
        } ### 通過grok匹配內容並將
     
        date{
                match => ["datetime","yyyy-MM-dd HH:mm:ss.SSS","yyyy-MM-dd HH:mm:ss.SSSZ"]
                target => "@timestamp"
        } ### 處理時間
}

output {

    if [type] == "type1" {
        elasticsearch {
​        hosts => "192.168.1.158"
​        index => "fp_log_type1"
          }
   }

    if [type] == "type2" {
​        elasticsearch {
​        hosts => "192.168.1.158"
​        index => "fp_log_typr2"
          }

    }
}
 

啟動es的前提下啟動logstash 

./bin/logstash -f log.conf &