[ELK] File 文件监控

input {

 

    file {

        path =>"/data/es-logs/oldboy.log"          #定义文件路径

        type =>"es-error"                                        #定义标签

        start_position =>"beginning"                    #从头读取

        codec => multiline{                                      #多行插件

            pattern =>"^\["                                         #以【开头

            negate =>"true"                                        #默认是false。若为true，则将不匹配的并入一行

            what =>"previous"                                  #what => "previous" or "next"上一行或下一行的关系

 

        }

    }

}

 

 

output {

 

    if [type] == "es-error" {

        elasticsearch {

            hosts =>["192.168.1.75:9200"]

            index =>"es-error-%{+YYYY.MM.dd}"

        }

    }

}