1. logstash-收集tomcat-log

input {
    file {
        path => "/usr/Elastic/test_tomcat_logs/localhost_access_log*.txt"
        start_position => "beginning"  #从文件开始处读取
        type => "tomcat_access_log"
        #sincedb_path => "/dev/null"
    }
}

filter {
    if [type] == "tomcat_access_log" {
        grok {
            match => { "message" => "%{COMMONAPACHELOG}" }
        }

        kv {
            source => "request"
            field_split => "&?"
            value_split => "="
        }

        urldecode {
            all_fields => true
        }
    }

    #定义时间戳的格式
    date {
        match => [ "timestamp", "yyyy-MM-dd-HH:mm:ss" ]
        locale => "cn"
    }
}

output {
    if [type] == "tomcat_access_log" {
        elasticsearch {
            action => "index" #es要执行的动作
            hosts => ["192.168.1.114:9201","192.168.1.114:9202"]
            #事件要被写进的索引，可是动态的用%{foo}语句
            index => "logstash-tomcat_access_logs-%{+YYYY.MM.dd}"
            #protocol => "http" #这个打开会报错
            #index => "system-message-%{+YYYY.MM.dd}"
            #一个默认的es mapping 模板将启用（除非设置为false 用自己的template）
            #manage_template => true
            #有效的filepath   设置自己的template文件路径，不设置就用已有的
            #template => "/data1/cloud/logstash-5.5.1/filebeat-template.json"
            #template_name => "my_index" #在es内部模板的名字
            #template_overwrite => true
            #document_type => "log"
            user => ""
            password => ""
        }
    }

    stdout {
        codec => rubydebug
    }
}