使用redis做缓存情况下，logstash配置文件示例

cat >/etc/logstash/config/redis.conf <<'EOF'
input {
redis {
host => "localhost"
port => "6379"
db => "0"
key => "ng_access"
data_type => "list"
}
redis {
host => "localhost"
port => "6379"
db => "0"
key => "ng_error"
data_type => "list"
}
}
filter {
mutate {
convert => ["upstream_time", "float"]
convert => ["request_time", "float"]
}
}
output {
stdout {}
# 输出，这的tags就是在filebeat那边新增的自定义字段名
if "access" in [tags] {
elasticsearch {
hosts => "http://192.168.53.21:9200"
manage_template => false
index => "nginx_access-%{+yyyy}"
}
}
if "error" in [tags] {
elasticsearch {
hosts => "http://192.168.53.21:9200"
manage_template => false
index => "nginx_error-%{+yyyy}"
}
}
}
EOF

原文链接：https://www.cnblogs.com/goujinyang/p/14949867.html