ELK之jason配置nginx文件等多个配置文件

[root@web02 ~]# cat  /etc/logstash/conf.d/nginx.conf
input {
	file {
		path => "/var/log/nginx/access_log_jason.log"
		codec => "json"
		type => "nginx-access-log"
	}

}

filter {

}

output {
	elasticsearch {
		hosts => ["10.0.0.18:9200"]
		index => "nginx-access-log-%{+YYYY.MM.dd}"

	}
	stdout{
		codec => rubydebug
	}

}

#正则匹配[  ] 两个括号之间的内容

[root@web04 conf.d]# cat codec.conf
input{
	stdin {
		codec => multiline{
			pattern => "^\["
			negate => true
			what => "previous"
		}

	}

}

filter{
}

output{

	stdout{
		codec => rubydebug
	}

}

[root@web04 conf.d]# cat demo.conf
input {
	stdin{}

}

filter {

}

output {
	elasticsearch{
		hosts => ["10.0.0.18:9200"]
		index => "logstash-%{+YYYY.MM.dd}"
	}
	stdout{
		codec => rubydebug
	}

}
=====================================
多行正则匹配

[root@web04 conf.d]# cat file.conf
input {
	file{

		path => ["/var/log/messages","/var/log/secure"]
		type => "system-log"
		start_position => "beginning"
	}

	file {
		path => ["/var/log/elasticsearch/my-es.log","/var/log/elasticsearch/my-es.log.2018-01-15"]
		type => "es-log"
		start_position => "beginning"
		codec => multiline{
                        pattern => "^\["
                        negate => true
                        what => "previous"
                }

	}
}

filter {

}

output {
	if [type] == "system-log" {
		elasticsearch {
			hosts => ["10.0.0.18:9200"]
			index => "system-log-%{+YYYY.MM}"
		}
	}
	if [type] == "es-log" {
		elasticsearch {
			hosts => ["10.0.0.18:9200"]
			index => "es-log-%{+YYYY.MM}"
		}
	}

}
================================
syslog 插件
[root@web04 conf.d]# cat sys.log
input {

	syslog{

		type => "system-syslog"
		port => 514
	}

}

output {
	elasticsearch {
		hosts => ["10.0.0.18:9200"]
		index => "system-syslog-%{+YYYY.MM}"
	}

}
===============

#TCP 通过端口传送到一个文件
[root@web04 conf.d]# cat tcp.conf
input {
	tcp {

                type => "tcp"
                port => "6666"
                mode => "server"

        }

}

filter {

}

output {

	stdout {
		codec => rubydebug
	}

}