日志格式:
LogFormat “% {clientip}小姐:% l % u % t \ " % r \”, %祝辞s % b \ " %{推荐人}我\”,\“%{用户代理}我\ ",\ " % %{饼干}{clientip} i n \ ",总和
日志实例:
183.60.150.34 安康安康;[23日/6月/2017:17:57:52 + 0800],“GET /跳/cps.jsp ? projectcode=0085001, cid=A200647189 % 7 c % 7 c0000& url=http % % 2 f % 2 3 fwww.mangocity.com http/1.1”, 302年,安康;“http://myhenan.qq.com/t - 7947749 - 1. - htm”,“Mozilla/5.0, (Windows NT 5.1), AppleWebKit/537.36, (KHTML, like 壁虎),Chrome/47.0.2526.108 Safari/537.36, 2345浏览器/8.6.1.15524”,“183.60.150.34.10.10.130.100.1498211872045986”
logstash配置文件:
input {,,
,,,,,,,file {,,
,,,,,,,,,,,,,,,type =祝辞,“www_access”,,
,,,,,,,,,,,,,,,path =祝辞,(“/usr/地方/麋鹿/elklog apachelog log0/www.mangocity.com-access_log”、“/usr/地方/麋鹿/elklog apachelog log1/www.mangocity.com-access_log”),,
,,,,,,,}
file {
,,,,,,,,,,,,,,,type =祝辞,“ro_access”
,,,,,,,,,,,,,,,path =祝辞,(“/usr/地方/麋鹿/elklog apachelog/log0/ro.mangocity.com-access_log”、“/usr/地方/麋鹿/elklog apachelog/log1/ro.mangocity.com-access_log”)
,,,,,,,}
}
filter {
grok {才能
,,,match =祝辞,{
,,,,,“消息”,=祝辞,”(%{用户:clientip} | % {IPORHOST: clientip} | % {IPORHOST: clientip},, % {IPORHOST}), %{用户:鉴别},%{用户:auth}, \ [% {HTTPDATE:时间戳}\],“%{词:动词},%{}数据:请求,HTTP/%{号码:httpversion}”, %{号码:回应:int},(?: - | %{:字节数:int}), % {QS:推荐人},% {QS:代理}'
,,,}
,,}
date {才能
,,,match =祝辞,[,“时间戳”,“dd/嗯/YYYY: HH: mm: ss Z”,)
,,,locale =祝辞en
,,}
geoip {才能
,,,source =祝辞,“clientip”
,,}
useragent {才能
,,,source =祝辞,“代理”
,,,target =祝辞,“useragent”
,,}
}
output {
,,,,,,,redis {,,
,,,,,,,,,,,,,,,host =祝辞,“10.10.45.200”,,
,,,,,,,,,,,,,,,data_type =祝辞,“列表”,,
,,,,,,,,,,,,,,,key =祝辞,“elk_frontend_access:复述”,,
,,,,,,,,,,,,,,,=港在“5379”,,
,,,,,,,},,
}
