日志分析平臺(tái)ELK之日志收集器logstash

1、日志分析平臺(tái)ELK之日志收集器logstash前文我們聊解了什么是elkelk中的elasticsearc集群相關(guān)組件和集群搭建以及es集群常用接口的說(shuō)明和使用，今天我們來(lái)了解下ELK中的日志收集器logstashlogstash的工作原理類似Linux里的rsyslog首先logstash會(huì)有一個(gè)數(shù)據(jù)輸入源，也就是logstash去哪里采集數(shù)據(jù)，它的采集數(shù)據(jù)來(lái)源很多，比如從文件中采集，從某個(gè)tcp/udp端口采集，從redis的消息隊(duì)列中采集，kafka啊、標(biāo)準(zhǔn)輸入等等；它和rsyslog不同的是，rsyslog是把日志數(shù)據(jù)從一個(gè)地方轉(zhuǎn)到另一個(gè)地方，中間不會(huì)去處理日志的格式，采集回來(lái)是什么樣

2、就是什么樣；而logstash不一樣，logstash它可以把采集回來(lái)的日志做格式化，以不同的編碼形式向外輸出；比如把nginx的日志采集回來(lái)，它可以以json格式輸出；同時(shí)它還可以處理采集回來(lái)的日志，比如忽略某些字段的輸出，把原有日志格式做切分；把原來(lái)不是json格式的日志，通過(guò)輸出規(guī)則轉(zhuǎn)換為json格式的日志；總體流程圖如下Monit*和鬥gMillAnalysisArchivingAlertrnglagstash提示：以上流程圖主要表示logstash采集數(shù)據(jù)和處理數(shù)據(jù)內(nèi)部的一個(gè)流程；從上面的流程不難想象，logstash就是把一個(gè)數(shù)據(jù)采集回來(lái)，通過(guò)內(nèi)部定義的處理規(guī)則，然后通過(guò)outpu

3、t規(guī)則輸出到指定地方的一個(gè)插件；安裝logstashlogstash的運(yùn)行方式有兩種，第一種以agint的方式運(yùn)行在數(shù)據(jù)源所在服務(wù)器上采集數(shù)據(jù)，然后輸入到指定地方；第二種是以server方式獨(dú)立運(yùn)行在一個(gè)服務(wù)器上，接受filebea從數(shù)據(jù)源發(fā)送過(guò)來(lái)的數(shù)據(jù)，然后在輸出到其他地方；logstash的運(yùn)行以來(lái)jdk所以首先要在運(yùn)行jdk的服務(wù)器上安裝jdk;logstas的版本最好同ELK中的其他組件版本一樣；安裝jdkyuminstall-yjava-1.8.0-openjdk-devel導(dǎo)出JAVA_H0ME環(huán)境變量raotinDoeUjjrViKijavausr/hi/javarootntde

4、03岸tchoExportJAvMOMEVusr/fltc/profil8.Vjaa.shIcar,e:c/pr:f1e.djava.sheortuv177,059,640136MB/s1.2s10.11.2020-10-0215:01:15(136MB/s)-logstash-6.8.12.rpmsaved177059640/177059640rootnode03#安裝logstash-6.8.12.rpmrootnode03#lltotal172912-rw-r-r一1rootroot177059640Aug1819:41logstash-6.8.12.rpmrootnode03#yumi

5、nstall./logstash-6.8.12.rpmLoadedplugins:fastestmirrorExamining./logstash-6.8.12.rpm:1:logstash-6.8.12-1.noarchMarking./logstash-6.8.12.rpmtobeinstalledResolvingDependencies-RunningtransactioncheckPackagelogstash.noarch1:6.8.12-1willbeinstalled-FinishedDependencyResolution12.DependenciesResolved14.=

6、PackageArchVersionRepositorySize=noarch/logstash-6.8.1218.Installing:logstash1:6.8.12-1294M20.21.TransactionSummary8.Install1PackageTotalsize:294MInstalledsize:294MIsthisoky/d/N:yDownloadingpackages:29.RunningtransactioncheckRunningtransactiontestTransactiontestsucceededRunningtra

7、nsactionInstalling:1:logstash-6.8.12-1.noarch1/1Usingprovidedstartup.optionsfile:logstash/startup.options/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/pleaserun-0.0.31/lib/pleaserun/platform/base.rb:112:warning:constant:FixnumisdeprecatedSuccessfullycreatedsystemstartupscriptforLogstashVerifyin

8、g:1:logstash-6.8.12-1.noarch1/1.42.43.Installed:logstash,noarch1:6.8.12-1Complete!rootnode03#提示：logstash安裝生成的文件超級(jí)多，其中主配置文件是/etc/logstash/lostash.ym配置日志收集規(guī)則、過(guò)濾規(guī)則、輸出規(guī)則的文件通常放在/etc/logstash/confld錄下以.conf結(jié)尾的文件；其實(shí)主配置文件基本不用動(dòng)，我們直接在/etc/logstash/confld錄下編輯日志收集規(guī)則配置文件，然后啟動(dòng)logstash即可；示例：編寫配置文件，定義log

9、stash從標(biāo)準(zhǔn)輸入收集數(shù)據(jù)，輸出到標(biāo)準(zhǔn)輸出；rootnode03#cat/etc/logstash/conf.d/stdin-stdout.confinputstdin5.outputstdoutrootnode03#提示：logstash數(shù)據(jù)收集配置文件格式是inputoutput其中input用來(lái)定義數(shù)據(jù)源輸入的配置，其中里面stdin表示使用標(biāo)準(zhǔn)輸入插件采集數(shù)據(jù);同樣output用于定義數(shù)據(jù)輸出的，stdout表示把input里定義的數(shù)據(jù)采集采集到的數(shù)據(jù)輸出到output里定義的輸出位置；以上配置就表示把標(biāo)準(zhǔn)輸入采集到數(shù)據(jù)，輸出到標(biāo)準(zhǔn)輸出；檢查配置文件語(yǔ)法是否正確USUIrw仙od朋*

10、邇妙猝丿網(wǎng)戢琲問(wèn)丫網(wǎng)5t&h-f旳5邏h/,業(yè)博咬血u:凹-t稠肛NG:Coildncr;ndlsnsh.yirliti:criistypicallyk-catsdink&.-ciLIwiFigor/etc；logstash,Vhipath.queue.:path1/usr/shar/legstash.data/quaKnJNFOM20-10-K15：p：2,46itrainftritahledirectory-treatingdirectory:srttingpatii.deaj_lEtter.queue11,:path=;uir/$hare/1ogstash川址a/dead.riter.q

11、ueue1；MRN2020-104E15:17:23.767logStash:Runnerioklocal-Ignoringthepipelines.yilfilebecauseBodjlesorccwndlinecptionsarespecified|tcnfigjraiticiiOKinfoM2O-1O-(I215:L/:i?,462LogStash:Runnerrunner-Usingconf;g,tst_ani.exitwde.CanfigValidationResult:X.ExitingLogstash；roonodeO3*f提示：f用于指定配置文件，-t表示檢查指定配置文件的語(yǔ)法

12、是否正確;configurationo表示指定配置文件語(yǔ)法正確；驗(yàn)證：?jiǎn)?dòng)logstash在標(biāo)準(zhǔn)輸入中輸入數(shù)據(jù)，看看是否會(huì)把我們輸入的數(shù)據(jù)輸出到標(biāo)準(zhǔn)輸出呢？提示：可以看到當(dāng)我們指定logstash以/etc/logstash/conf.d/stdin-stdout.conf配置文件啟動(dòng)，在標(biāo)準(zhǔn)輸入中輸入了helloworld它輸出了一個(gè)json格式的信息，其中message字段就是我們輸入的內(nèi)容；它這個(gè)默認(rèn)輸出就是用的rubydebug的格式向外輸出；當(dāng)然我們可以在輸出里用codec來(lái)指定輸出以那種格式輸出；示例：指定輸出格式用json格式輸出Inodedll|#H0d胳叫律hkM扣弓x-ru

13、nner-StartingLogstashrlDgszish.vers-on1=6.8.12gePi3a1inflAttiwi:Creitflpipeline“Btarzngpipeline:pipelineJd=irain,pipelinrh.:J;e.L八丄兒1-yrnl_2020-10-0215:45:57.717converqeFipelineAction!:create4ffiitpipeline-Pipelinestartedsuccessfully:pipelinejnJn:tliread=f：2020-10-0215:45:57.77&nuby-O-Ttrud-2:/usr/s

14、lur/lMstasli/lib/bo0tstrap/environrent.rb：6agent-Pipelinesrunning:cig_pipeline$=:irain,:no(i_ruminfl_pi3lins=202040-02:45:57.SIC曲訊M叩td-5T職T,creat-ngDis:overerhMatchrdthfileandiincedbcollections2020-10-021S:4S:S89600提示：可以看到當(dāng)我們?cè)谂渲梦募兄付ㄝ敵鼍幋a是json格式以后，啟動(dòng)logstash看到logstash輸出格式就是以json格式輸出了；示例：配置logstash從文件

15、中采集數(shù)據(jù)，輸出到標(biāo)準(zhǔn)輸出，輸出格式為rubydebug-#Clt/etr/staih/conf.dfllF-StilsUt-CCrtfnajtf-ipath=；77ar/log/t$t.lcglstapt_posifiDn=jflflinninq1rypd=,tt5：.logoiftsutstdoutcfriac=ribydebu也惰“d嗣十/亨坪甲郵忖即中nju胖制卜二仲護(hù)d眄需巴如廠卅巧2-斗竝：.歧柑：廠nWUIIHG：Couldnotf;ndlogstasi.ymlmtiich5typicallylocatednSLSjHCME/canfigor/Etc/logstash.Youcm

16、sptrifythepthls-psth.uttlrMS.continuingusingthedefaultsQuidnotfindlog4jZconfijurationatpath/Usr/dwne/1agrtuh/corfigi/loptjZ.properties.uiingdefaultconfigwtridilogserrorstntheCCTisoleWNl2020-10-02Loqstjsh:Runnernultilocal-珈wringthepipeliiHs.yiTfilebecausenodulesorcomandlinecptimsar*specitUdConfigurat

17、ion0L科PJFP旳皿-訃?yán)f(shuō)輸21.山7logstashnimerrurmer*u$inggfig*tewancL耿itiwde,configvalidation肚汕t:OK-ExitingLogtjsliroKSntdaOS|提示：以上配置表示從/var/log/test.中采集數(shù)據(jù)，開始采集位置上文件最開始處，類型為test.log輸出以rubydebug格式輸出到標(biāo)準(zhǔn)輸出；驗(yàn)證：以/etc/logstash/conf.d/file-stdou啟動(dòng)nfogstash看看完test.lo中追加內(nèi)容，它是否會(huì)輸出到標(biāo)準(zhǔn)輸出呢？tmdrfl-41X審如七0|孑制砂|巾血nod曲3”門吧妙猝/

18、!ogt他/bj叩碼戲鮎h他屮層t3$IV少F,卅冃1e-各血u:,申nf”禮訓(xùn)肛肪：Couldnotfindlegstash,ymliiciistypicallylecinSLijWE/confgnr/e：c/loghh.youcanspecifthepathusing-path.settings.ContinuingusingthedefaultsCouldnotfindlog42configurationatpathhsrfshane/logstash/carFig/log4j2.pnoperties.Ufngdefaultconfigwhichlogsenwstotheconsolen

19、AHN2020-10-0215:45:53.137botah:Runnermiltiloca-lyiorngthebipmFn出,yiTf_ebecausenadulescrccnnandlinecptionsarespecifiedINFO2020400215:45:53.147botash:Runner:INFO2020-10-0215:45:57.423Ocn-(一ne.horkers-2,pipeline.batch.size=125,ipeli嚀,batdi.cflay=5ijINFO2020-10-0215:45:57.681nuin-pi3slinH-nianig5r-Notir

20、KsdD_pathsez,generatingoneonthepath1setting:sincedb_pth=7u3r/share/lcgstash/data.p】uginput5/fi/.sLd：_be757cd3c&4?65beZ73ZbZZS02bf,:path=?7ar/lcg/te比伽INFOINFO.ount=Lr:running_pipeline$=:irain:nod_runniig_pi3lin5=infojNFO提示：現(xiàn)在啟動(dòng)logstash可以看到標(biāo)準(zhǔn)輸出上沒有輸出內(nèi)容，原因是我們指定的文件現(xiàn)在沒有數(shù)據(jù)，所以它沒有什么數(shù)據(jù)采集；向/var/log/test.中追加數(shù)據(jù)，

21、看看在標(biāo)準(zhǔn)輸出中是否會(huì)有對(duì)應(yīng)的內(nèi)容以我們?cè)谂渲梦募兄付ǖ母袷捷敵瞿?？沖剜叫町*1呻咽?-RGCpOjp,2JB冋虬/1悶口何侏門皿小13：.：Irwtflnocte03/nsr/sharfl/loBstashin/logtstaUn-f/fltc/logstash/corrFd/fik-svdQutrCflrifrawing：couldwtfind15tashynlwMchIstypicallylocatedtnSUjONE/wiFigorstash*vancanspecifythepathusingtilth.settings.CcntlnuirigliningdudefajultsCou

22、ldnotfindTlcg4j2configurationatpath/usr/shart/1ogstash/config/1ag4j2upropertyts.Usimgde-faultccnfinhichlogssrrorstotheconsole刪2(t2(l-lC-O215,45:53.137(LogStwh:Runne-rnultiloul-Ignoringthepipelines.ynl1filebec&ustnodulesorcomandlineopti-wisarespKifiidinfo2020*10-0?15:45:53,147|Log5i;hRunnerrumnar=sta

23、rtingLcsgtstashHogtstashi,vsrsion6-8,12*INFOJ2A2O-1O-O215:45:57-428ConvergePipelineAcriw：:CresatepipelineStartingpipeline:pipelIneickniKiinn.Wpeline.workers!tplceline.batch.sizen125,pipeline.batch.delay，!50EHKk12O2Q-LC-G215:4k5T.6Sliiain|-p1pe11ne-iianagerlfile-noslmdbrathBet9gewratirucmbasdonthepat

24、h11setting:siixsdbjpath=!7ur/share/logitash/dataypliigfins/iinputs/hk/-sihdbJB86fi7S7cdk64785be27B2b228O2b,f,:pah=*7曲叨aj/test.Tag1EhlFD2020-1-0215:45:57.717iTconvrgePipelin-eAction:Createpipeline-Pipelinestarttdliuccssfmllj1:pipeline_id=i,iiiainP:thnad=njkThr8ad:0 x7ftS123druninfu2020-10-0115*5:57,7

25、TBRubj-O-Thrid-J:/uir/shir-i/logstsh/lib/bTOtstrap/sm.1!rgniwnt.rib:6邨ntPipslinesrunninggmntlF:runmno_pipl-ine?*:m?in;nQn_runnin_pip1-inesJinfo2020-10-02145:57.810na1m,nodCi3.te5t.!3rgl,!patti=iiwssage=thisisttstlo.，!tyw，1先能匚IcgSetwsta=2020-10-02T07-45:11-6512提示：可以看到我們?cè)诹硗庖粋€(gè)終端向/var/log/test.中追加數(shù)據(jù)，在標(biāo)準(zhǔn)

26、輸出中可看到logstash把對(duì)應(yīng)文件中的數(shù)據(jù)采集到，并輸出到標(biāo)準(zhǔn)輸出；示例：收集httpd的日志到es集群中；訪問(wèn)httpd然后到es上查看對(duì)應(yīng)的日志信息是否有?,ntt3:a.ode5iarci?q=ffJ85sage;-：fal5eh.shard；:total:10,sukss5和1ilO/ski即曲;0hfailed;01,hits7:Hrtali/mM.scare;1.Q*hitLtpe:dMd:4jfiHt!E0bkSRS95p5E7h：1.0fsouree*-pi:fittpd.Wr魏inutaqi:20M-10-0270S:&4:52.$212”.f,viriion:VQET/

27、index,htmlW208V-匕叨,擬就由cH血陽(yáng)屮如Td;僭砌r*.-；f,|r-._一.一.it2F:rpth:*/var/lDg/littpd/acM5i_Tagt*hw:_r；MSH4，:IK.100.3-7卩瀘ctJrIS祀i卅$t眄“4034897VIIEtpil.1討,Stimjairp:濫Q-IQ-；鶉:05:52J55巧ncfls/css/fonts/R引d/apinSiis*?ld-ttftt*：.1faccessjM/hostinooj.tut-org-Pty|Pt：httpd,1m/nessMei-lSLlM，桁-02/0/2020:16:05:0140MNVGET/

28、HTTF/Lly_tpc:dac,_id:SflWtHQpD3$RS95?4B7,_5corc:L.Q,_5wrcc:pith:/w/lag.lit:%tpd.log,?2ft!0-10-&2t:05:1S.472T,rsion/1C.nes5秫:1J2.J1磅貯V-Vcurl0:jndexR:httpd.log,type:doc；*:*Mr/log/httfd/actftss_16g,host:.*rtyje:httpd.log祁4397Vajrl/?.M,onM,I_iniex:httpd.log,:Jac,r_id:0k陸勰陽(yáng)HTinGB(間”,score=:Lq”_wur(曠:卄胡皿“

29、z血-tT.*g,:yper:netpd.1ocA,fttirtieEaiip：F2020-ljO-DJlOfi：05：IL.4&5Z,siw:1CBOQ：.E-nP；L._:;5-39/c.r1.7.2=.O,：_indt:mtid.Iog1._tl.r.z、.,刑w.r：1.,.saurs:Tsflth:/var/log/Tittpcl/Mctss.hg,htst:ncdsOJ.,，u-ht曲l&C加檔菌np譏垃(XL卜曲PW：的：25Mb馳咋1卅【時(shí)”比需磷丫讀丄關(guān)443-02/001/2020tit:24408Hnp/l.lV4034刪V-V*O1H?-,f_1nder:httpd.1

30、ogtyiM:dota1d:7OVt6H(kSll595(CVd.stDre-*:1.0：rr/mw5flgs：rl?.l_.h?ri!/1&21ES.0.45/flaifldex/ess/oten-sans.;ss?J_:ndfx：htd.1的，_：ypt:槪:PIst:nocflOJ.,twc:httpd.1ag51t/?020：16：Sl-0800?曠門e4；yfi4：fv:81.DGeekD/2Ol10L61卜/d&v/nullIroDtntdeO-Ucurlhttp:/152.16B.Q.3&?denjlIfroPtncdeOj-.l?curlitts:/192.1&.0.fc/dc

31、x/njllrQQt&rwdeOJcurllittjj:/nadeiU:$200/_Mt/indicescreihttsj.los224nrtbtfnB6sf0qEub45140C34:.2kb172.GkbqreenMtnmyinftKeiRVSflyCR.+CJRkoTZrkSEj51LCK.5kb5.2kbIrOptPnpd(Q3小“1twkT：71rtiHed.wtA：-Ltpd.M,t:iodc3.12020:16:04:52hASOBHWftkS95s?tPK,jMrei1-Q,.50urceipathr/iostwd/awess.lw/hosfrnwIeQJ,test-or:s2

32、tt2D-ir-OM8：D5:02.4L5Z*.囁rsiaT:V.tits逖門152.通-Vourl/7.H.04,f_1ndw-:httpd.1og1,.13d/acce55_1og,rho.5t:npJeO3-test.t1og,*hwt:noide03.test.or-02Ort/2D20:L6:D5:2ttT可:doc,Jd:TuvM蔽tk595衛(wèi)de.swr*:1rVarl/r.B.dr_1ndex:httpd.log%:dat,-_1d:7OVt&iqpttkSft595C(CV,d.scDrd.D,_SMirte|id/u_log,:didtQ3.tut.wg,typt:%tpd

33、.1eg,Stiinstanp:112020-10:09:52,155巧氣mriiwiU0.21!-臨Awf血Q:l$:購(gòu):F：1皿Ven/血汕;弭陽(yáng)曲球腫扳卩和詢冷譏.十wnr/Lir4042SVNMlS.O(AHrtCfintN-S.L；hin81；s64；ru：iiL.0)GMko/201M101ffeftx/SL.OX1_PkF：5H述FNHTiTxfiOaGS,_tcnr：1一_swret兀出：/var/1&j/httpdyaecM!oa.hc,intstmpr:202M(-Ci2-ra8:52.L51Z,on:4l,msssjgt:192.liS.0.232-M/Ociwsrtcb

34、v.png|-J1P/L.12Dt站詁.http:.It3.0.43/ilh/S.(windersllmEiJt/51.,.lrtdfex:htlid.1Mlype，：，dM-Id：T7-VCfiHQ3CbkSRS9iqad:L.0,tifpath”:T7var門前/http4/access_l*,hostY,:.t滬S%t”d.1,匹tintst?2020-10-02708:IB:54.1642/rsim1:AFrnn5saw132-0?Att/2020:W:(:53406001*,QET/Inaws/poNrsdby.pngHTn71”lf304-nhttp:/B2,lM,弓,一-J八*；

35、族茄曲)1血ri,0Vk_indethttpJ.1rtvpe;dKTt丫血八的2itpd/atiessjm.host:ftriode03.rest.ora.問(wèn):,itd.log,sa：192.1B.aJ32-0?/OttD20：16：09：53tOBflOlGET伽胡朋閣-WT6rk提示：可以看到在es集群中有對(duì)應(yīng)的index生成，并且里面內(nèi)容也是我們?cè)L問(wèn)httpd的日志；從上面收集的日志來(lái)看，它是把日志內(nèi)容當(dāng)作message字段一個(gè)字段輸出，通常這不是我們想要的結(jié)果，這樣收集的日志，對(duì)我們來(lái)說(shuō)沒有太大的意義；我們需要讓logstash幫我們處理，把日志內(nèi)容切分成多個(gè)字段，然后再輸出；示例：配

36、置logstash切分日志，然后保存到es集群filtergrakKtch=rmcs&aas=SHTTPD_mreiNEDU06remav_fiild=nda|審Z皿血|irwd期射襯*仙k血型山。伽dW44roDtn&deOJ-#cat/etc/logstash/conifJ/httpd-es.conf皿氐path-a/w/1cg/http(|/accesLlegst4rt_5&$iti&i=begnnngtype=httpd.legoutputelasticsearchhosts-rhttp：/node01!$20httpi/VnetkZ:比閭”index=j-hfttpd.logc&di

37、crrjbydebugItJroctnodaOS-i提示：logstash處理日志依賴filt插件，其中g(shù)rok是filt的核心插件，它內(nèi)置了很多正則表達(dá)式，對(duì)常用的的日志做精準(zhǔn)匹配；以上filt插件主要做了兩件事，第一把message字段通過(guò)內(nèi)部的HTTPD_COMBINDLOG做了字段切分；第二件事，把原有的message字段刪除，避免同一數(shù)據(jù)多次收集；驗(yàn)證：檢查配置文件語(yǔ)法，然后啟動(dòng)logstashtnodBM-411WiDdBK42X晌加431|iwde(M44LJ.#1(=邙.f-tWARNIN-G:Couldlno：findlcgstash.ymlfthichistypically

38、locatedinSLiHub/ccnfiior/etGjlogstash.Ycutanspecifythepathjsing-path.sitings,continuinguingthedefaultscouldnotfindIog4j2configurationatpath/usr/shaFe/logstadi/config/perties.LUirMehultconfigwhichlogserrorstoth*consolemlUI12020-10-0217:11:26.LSDLcqStash:Runn;raultilocal-Ignoringthepipelines.yilfilebe

39、causen&dulesorocnmarMlineoptionsarespecifiedconfigurationokINFO2020-10-(13xkH:30445Logstadi:Runnerrunner-llsingconfig.testjnd.exitnode,configvalidationResult:flK.ExitingLcgstasriXrcot3node03啟動(dòng)logstashroijtgiriGijEOl亠#uE：T/E：hre/1l*DcistmhFljiiri/llDCi：5taLhf(6!上花丿11口上超審1/聞#.41|11：1：口小己：5,匸01干W嫌NtNif

40、i:亡ewuldirotfirtdlogatdish.wtiieh-iscyjsieallylocated4力1LJOHE/eeHtfJgiz/etc/lisgsrdishi.Ycu匕總片ipeiifythtpAthiisiinqpath.ContinvingusingiHdtfiultjCpipeline-starting：pip*line_1d=MinF，!piMlin*-wrk*rl=2rIptlirwrbatchrs1x*,=125.plp*l1abatcfiray=50riNFiffJ0i(-10-0217:12;47,30main-pip*lim-msnagfrJilfljticw

41、arch-ElaticfarchpoolUFiLsupd#d：uhain滬鼻=rrerrwvedLs:add&dl HYPERLINK http:/nodeOl http:/nodeOl:?2w/,http:/nodeflZ:92M/:WARN2020-10-0217:12:47-788main-pipelime-managerslastic&EarchRestored匚ofinectiontoE5instance:u1anmp:/nodeOl:920O/,!INFO2020-10-0217!12i47.13mainj-plptllimits*打亡k-&SGutpurirsiend*士廣fdn

42、胡】匸“一幻譽(yù)“wrmWRN102-10-0217:12:47,5iJQmaini-pi嚴(yán)1訕耐代滬evintfieldwontbfusedtodteternin-ethedocumentWARN12020-10-0217:12247.932mainhitp:7/nodi01:9260；http:/nwftOS:92O0riNFOF-i-jJ4八J-LINF1&皀lpstlcwarch-ctvda6rx$nd丹日。*dust：th*typ6ElasticsearchRestGredEOfinectioctoE5instance:url,b2020-1&-0215!12i47.M5maih-pi

43、plii)e-mangerlsearch-hi如ClasrlesaarchOutput;1&5=，11LfiaSc&sh亠J，-八石!http:/ncKtCi2:92,_aefault_ppinotyp皀/,string.mappingfty“p凈囚乩Sr*rcl*i2Q2Q-1D-D217:12:47.97血內(nèi)-0-*Wld-&：1】.1話一ZQESlflrQEL7：L2；48,W3|_尺心廠4卄1“小總：二_._/._”_._.tenplatefclogstash-*11(,version60001(,setti門護(hù)index-refreshu.1nterv-aT%s*(.mappings

44、=_,二，mappingC1irrtiareh_rtiap|i1iimappingirtcype,i|A,B1nor,B=?56.Spropir：isc1rntsu_rJdynamic.*pr仲卄*s=11訶先次護(hù)r5phalf.-flwtPJ*lcngitudK=*typ=halfflwtJJ-5_：_generating口口芒Basedonthe*pa_-_.-sincedbJiS94CcadS3ddiLd99B08fieaed6f6ad3rh17:12:48.5O2-c6nvthgtp1p1iMActlwn:Crtatt-mlnpfptHrvt-Plp*Hntatarttdsuecusf

45、ull:pi:thrtad=icflhriad:典理21ZOt9runo-*1-start3criafiingd話匚tenplate*1ogstash-*111v=iauri-A口uuuxi，lq_uriuim*liilktaichidynani_templatesrr,message_fi1dpath_matcn,pmeEsa-Qematci!rteKta,.falseiI.%tr4n_Fields=rtiatdi,，B,B,ffrtiarehFcmtwF刊1呱fl1dsCkwanitypelEfywarA伸“p“typu=datfisimFrtvpt=k*y帕d,p=dynaiPIAGJt

46、iofi,bs.*typ1ntfPAiatitud#-3,fehalf;_Tllcmt-r.INFU2020-10-0217:1243-474main-pipeline-managerfile-Nosincedb_pathsetth,Bsettingzsin匚edb_path/usr/share/IastaEhi/data/plugins/inputs/file/a:path?-VvarHog/htxpd/accejs_laglINTO2020-10-02L1：7：:氣：ptl1rrt_id=iainlthrtad=!，#riNFO?D2Ci-10-fl217：12i43.$7iSXpi舶旺-

47、uCts$iFull旺苦壯屈l時(shí)址昭RAPItndpCblnt:p*rt=56Cfl0rIEM|VnairfS*IMM345l1C|*nodrfj；*山|晉031如.清空原有訪問(wèn)日志，然后訪問(wèn)httpd在es上查看收集的日志0node3L-41*nodri343*iddrtliSdncdU-U/veriident1:7abt.I我?guī)?fttlKS:JndeK:httpvtrsrrerrar：T2O2O-U0-OrGanodaOScurlhttp；/nodiOl;9SCO/_$4arch?q=request;卜tW期ti惟d_out”:也bF.shards,p:ft&tal:10”re:1.2gr1_ty；html.httpversion.L.L.agent1”亞矗rr詁YVY詫rb：ETtanp:2Q2O-1Q-O2TG9:17:30.9592httpd.log.type/doc/.!;1fln