#檔名稱為flume-es.conf

#定義sources,channel和sinks的名稱

agent.sources = tail

agent.sinks = elasticsearch

agent.channels = memoryChannel

#配置source的詳情

agent.sources.tail.type = exec

agent.sources.tail.command = tail -F /var/log/secure

agent.sources.tail.interceptors=i1 i2 i3

agent.sources.tail.interceptors.i1.type=regex_extractor

agent.sources.tail.interceptors.i1.regex =(\\w+\\s+\\w+\\s+\\d+\\\:\\d+\\\:\\d+)\\s+(\\w+)\\s+(\\w+) 

agent.sources.tail.interceptors.i1.serializers = s1 s2s3  

agent.sources.tail.interceptors.i1.serializers.s1.name= time  

agent.sources.tail.interceptors.i1.serializers.s2.name= hostname

agent.sources.tail.interceptors.i1.serializers.s3.name= service   

agent.sources.tail.interceptors.i2.type=org.apache.flume.interceptor.TimestampInterceptor$Builder   

agent.sources.tail.interceptors.i3.type=org.apache.flume.interceptor.HostInterceptor$Builder  

agent.sources.tail.interceptors.i3.hostHeader = host

#配置channel的詳情

agent.channels.memoryChannel.type = memory

agentes.channels.channel1.capacity = 1000000

agentes.channels.channel1.transactionCapacity = 5000

#agentes.channels.channel1.keep-alive = 10

#配置sink的詳情

agent.sinks.elasticsearch.type=org.apache.flume.sink.elasticsearch.ElasticSearchSink 

agent.sinks.elasticsearch.batchSize=100 

agent.sinks.elasticsearch.hostNames=127.0.0.1:9300 

agent.sinks.elasticsearch.indexName=linux_secure

agent.sinks.elasticsearch.indexType=message 

agent.sinks.elasticsearch.clusterName=elasticsearch 

agent.sinks.elasticsearch.serializer=org.apache.flume.sink.elasticsearch.ElasticSearchLogStashEventSerializer 

#配置source、sink和channel的詳情 

agent.sources.tail.channels = memoryChannel

agent.sinks.elasticsearch.channel = memoryChannel