ELKlogstash根据不同日志来源创建索引

条件判断

日志的来源放在不同的索引

现在要做的就是将采集日志的来源放在不同的索引里面。如果不这样配置那么在logstash采集的日志都会输出到一个索引里面，这样是不利于对后期的管理的。因为索引相当于数据库，按天命名方便清理。把同类的日志放在同一个索引里面。

下面是根据环境采集日志

[root@localhost ~]# cat /usr/local/logstash/conf.d/test.conf
input {file {path => "/var/log/nginx/*.log"exclude => "*.gz"start_position => "beginning"tags => "web"tags => "nginx"type => "access"add_field => {"project" => "microservice""app" => "product"}
}file {path => "/var/log/test/test.log"add_field => {"log_type" => "test"}
}file {path => "/var/log/test/prod.log"add_field => {"log_type" => "prod"} }
}filter {json {source => "message"
}if [log_type] in ["test","dev"] {mutate { add_field => { "[@metadata][target_index]" => "test-%{+YYYY.MM}" } }
} else if [log_type] == "prod" {mutate { add_field => { "[@metadata][target_index]" => "prod-%{+YYYY.MM.dd}" } }
} else {mutate { add_field => { "[@metadata][target_index]" => "unknown-%{+YYYY}" } } }
}output {elasticsearch {hosts => ["192.168.179.102:9200"]index => "%{[@metadata][target_index]}"}
}

测试一下，生成数据

[root@localhost ~]# echo "this is test" >> /var/log/test/test.log
[root@localhost ~]# echo "this is prod" >> /var/log/test/prod.log在浏览器上访问nginx

 可以看到根据不同的日志来源创建了不同的索引，不同的索引里面存放着不同的日志信息