doina

一个小菜鸟运维工程师.

Filebeat+Logstash自定义多索引

filebeat里添加document_type配置,定义一个识别号- input_type: log

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/logs/xx.log
  document_type: xx
  paths:
    - /data/logs/aa.log
  document_type: aa


然后在logstash里配置对应的type
output {
    if [type] =="xx"{
            elasticsearch {
            hosts => ["*.*.*.*:9200"]
            index => "xx-%{+YYYY.MM.dd}"
            document_type => "log"
        }
    }
    if [type] =="aa"{
            elasticsearch {
              hosts => ["*.*.*.*:9200"]
              index => "aa-%{+YYYY.MM.dd}"
              document_type => "log"
                }
    }
}
点赞

发表评论

邮箱地址不会被公开。

此站点使用Akismet来减少垃圾评论。了解我们如何处理您的评论数据