test1.conf
input {
file {
codec => plain{ charset => "GB18030"}
path => "F:/tools/elk/logstash-2.4.0/log/filter/1.log"
type => "result.log"
start_position => "beginning"
#sincedb_path => "/dev/null"
}
}
filter {
csv {
#csv文件每个字段名称
columns => ["ip_address","mac_address","hostname","workgroup","network","results"]
separator => ","
}
}
output {
elasticsearch {
codec => plain{ charset => "UTF-8"}
action => "index"
hosts => "localhost:9200"
index => "separator-%{+YYYY.MM.dd}"
workers => 1
}
#stdout{codec => rubydebug}
}
test2.conf
input {
stdin{
}
file {
path => "F:/tools/elk/logstash-2.4.0/log/filter/2.log"
start_position => "beginning"
}
}
filter {
mutate {
split => ["message" ,","] #message以逗号为切割点
add_field => ["client", "%{message[0]}"] #取出数组中第一个值,同时添加request_url为新的field
add_field => ["method", "%{message[1]}"]
add_field => ["request", "%{message[2]}"]
add_field => ["bytes", "%{message[3]}"]
add_field => ["duration", "%{message[4]}"]
add_field => ["usetype", "%{message[5]}"]
}
}
output{
#stdout { codec => rubydebug }
elasticsearch {
hosts => "localhost:9200"
index => "split-%{+YYYY.MM.dd}"
}
}
test1.conf、test2.conf 在 conf 目录下
执行 logstash -f ../conf/
但是两个index 内容都是一样的,怎么回事呢?
input {
file {
codec => plain{ charset => "GB18030"}
path => "F:/tools/elk/logstash-2.4.0/log/filter/1.log"
type => "result.log"
start_position => "beginning"
#sincedb_path => "/dev/null"
}
}
filter {
csv {
#csv文件每个字段名称
columns => ["ip_address","mac_address","hostname","workgroup","network","results"]
separator => ","
}
}
output {
elasticsearch {
codec => plain{ charset => "UTF-8"}
action => "index"
hosts => "localhost:9200"
index => "separator-%{+YYYY.MM.dd}"
workers => 1
}
#stdout{codec => rubydebug}
}
test2.conf
input {
stdin{
}
file {
path => "F:/tools/elk/logstash-2.4.0/log/filter/2.log"
start_position => "beginning"
}
}
filter {
mutate {
split => ["message" ,","] #message以逗号为切割点
add_field => ["client", "%{message[0]}"] #取出数组中第一个值,同时添加request_url为新的field
add_field => ["method", "%{message[1]}"]
add_field => ["request", "%{message[2]}"]
add_field => ["bytes", "%{message[3]}"]
add_field => ["duration", "%{message[4]}"]
add_field => ["usetype", "%{message[5]}"]
}
}
output{
#stdout { codec => rubydebug }
elasticsearch {
hosts => "localhost:9200"
index => "split-%{+YYYY.MM.dd}"
}
}
test1.conf、test2.conf 在 conf 目录下
执行 logstash -f ../conf/
但是两个index 内容都是一样的,怎么回事呢?
5 个回复
Mariana_
赞同来自:
medcl - 今晚打老虎。
赞同来自:
laoyang360 - 《一本书讲透Elasticsearch》作者,Elastic认证工程师 [死磕Elasitcsearch]知识星球地址:http://t.cn/RmwM3N9;微信公众号:铭毅天下; 博客:https://elastic.blog.csdn.net
赞同来自:
es5.4验证ok
bloodzer0
赞同来自:
zqc0512 - andy zhou
赞同来自:
5建议启多个实例。