input{

     file{

        path=> "/diskb/bidir/smartbi_prd_*/apache-tomcat-5.5.25_prd_*/logs/catalina.out"

        start_position=> "beginning"

        sincedb_path=> "/diskb/logstashlog/log"

        codec => plain {

             charset => "GBK"

        }

     }

}

filter {

     multiline {

            pattern => "^\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}"

            negate => true

            what => "previous"

        }

    mutate{

        add_field =>   {

                "logmessage" => "%{[message]}"

         }

        split => ["message"," "]

        add_field =>   {

                "logdate" => "%{[message][0]}"

                "logtime" => "%{[message][1]}"

                "logstate" => "%{[message][2]}"

        }

        remove_field => ["message"]

    }

    if [logdate] !~ /\d{2}-\d{2}/ {

        drop{}

     }    

     urldecode {

         all_fields => true 

     }

}

output{

       #對錯誤的日誌寫入到檔案中，供郵件傳送使用的附件

       #其實在這裡可以直接使用logstash自帶的郵件傳送系統，只不過部門要求郵件傳送的頻率不能

#高於一分鐘，故只能採用外部定時傳送

       if [logstate] =~ /ERROR/ {

         file {

           path => "/diskb/bi_error_log/bi_error.log"

          }

       }

        elasticsearch{

          hosts => [ "10.130.2.53:9200","10.130.2.46:9200","10.130.2.54:9200" ]

          flush_size=>50000

          workers => 5

          index=> "logstash-bi-tomcat-log"

        }

}

#!/bin/sh

#sendmail error log to someone

#傳送的附件路徑

attachement="/diskb/bi_error_log/*.log"

if [ ! -f $attachement ];then

echo "file is not exist"

exit 1

fi

#收件人

maillist="[email protected]"

 cat > /etc/nail.rc<<EOF

set [email protected]

set smtp=60.28.250.158

set [email protected]

set smtp-auth-password=******

set smtp-auth=login

EOF

#echo "郵件內容" | /usr/local/mailx-12.4/mailx -v -s "郵件標題" [-a "附件路徑"] [-c "密送人mail"] 收件人

echo "Hello, please receive the error log for BI from hexun.bdc." | /usr/local/mailx-12.4/mailx -v -s "[The system sends]" -a $attachement $maillist

#傳送成功，刪除檔案

rm -fr $attachement