ELK logstash郵件報警
阿新 • • 發佈：2017-06-12
ava port test mov message 2.6 cor line gem
/* */]input {
beats {
type => beats
port => 5089
}
}
filter {
multiline {
pattern => ".*#ELK#.*"
negate => true
what => "previous"
}
grok {
patterns_dir => "/data/package/logstash/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-2.0.2/patterns"
match => {"message"=>"%{DATA:Date} %{LOGLEVEL:Level} %{JAVACLASS:Class} %{NOTSPACE:Thread} %{NOTSPACE:RequestId} #ELK# %{MSG:msg}"}
remove_field => [[email protected]
remove_field => [‘message‘]
remove_field => [‘offset‘]
remove_field => [‘input_type‘]
remove_field => [‘beat‘]
}
}
output {
elasticsearch {
hosts => ["10.19.192.69:9200","10.19.2.20:9200"]
index => "test-web1-front-%{+YYYY.MM.dd}"
}
if [Level] == "ERROR" {
exec {
command => "echo ‘pro_front %{host} %{Date} %{msg}‘ | mail -s ‘Log_error‘ [email protected]