橡皮、老虎皮、狮子皮哪一个最不好?

filebeat输出到es加载多个index以及index template,如何配置达到这样的要求???

Beats | 作者 Aruen | 发布于2019年01月08日 | 阅读数:6026

filebeat.prospectors:
- input_type: log
paths:
- /var/log/man/*.log
document_type: "man"
tags: ["man"]
json.keys_under_root: true
json.overwrite_keys: true
- input_type: log
paths:
- /var/log/woman/*.log
document_type: "woman"
tags: ["woman"]
json.keys_under_root: true
json.overwrite_keys: true
processors:
- drop_fields:
fields: ["@timestamp","sort","beat","input_type","offset","source"]
output.elasticsearch:
if "man" in [tags]{
hosts: ["45.106.132.69:9200"]
index: "man-%{[date]}"
template.path: "/usr/template/man.json"
template.name: "man"
template.overwrite: true
}
if "woman" in [tags]{
hosts: ["45.106.132.69:9200"]
index: "woman-%{[date]}"
template.path: "/usr/template/woman.json"
template.name: "woman"
template.overwrite: true
}
已邀请:

rochy - rochy_he

赞同来自:

output.elasticsearch:
hosts: ["http://localhost:9200"]
indices:
- index: "warning-%{[beat.version]}-%{+yyyy.MM.dd}"
when.contains:
message: "WARN"
- index: "error-%{[beat.version]}-%{+yyyy.MM.dd}"
when.contains:
message: "ERR"
 
可以参考上面的案例进行配置

Aruen - 算法工程师

赞同来自:

 
索引可以多个配置,但各个索引的索引模板如何加载,这是个问题?
template.path: "/usr/template/man.json"
template.name: "man"
template.overwrite: true
上面三行该如何设置?


output.elasticsearch:
hosts: ["http://localhost:9200"]
indices:
- index: "warning-%{[beat.version]}-%{+yyyy.MM.dd}"
when.contains:
message: "WARN"
- index: "error-%{[beat.version]}-%{+yyyy.MM.dd}"
when.contains:
message: "ERR"

要回复问题请先登录注册