RError.com

RError.com Logo RError.com Logo

RError.com Navigation

  • 主页

Mobile menu

Close
  • 主页
  • 系统&网络
    • 热门问题
    • 最新问题
    • 标签
  • Ubuntu
    • 热门问题
    • 最新问题
    • 标签
  • 帮助
主页 / 问题 / 1269599
Accepted
Jacki
Jacki
Asked:2022-04-13 18:26:27 +0000 UTC2022-04-13 18:26:27 +0000 UTC 2022-04-13 18:26:27 +0000 UTC

logstash 配置文件

  • 772

大家好,告诉我这段代码是否正确:

if [type] == "" or [type] == "" or [type] == ""

如果不是,在这种情况下可以使用哪些枚举运算符,在 if 块中,对所有带有 type 标签的对象进行检查,对象如下所示

file {
type => "runstatus12"
path => "C:/BuildAgent2/work/baef4ea7e758f5b8/dms-selenium-tests/TestSelenium/bin/Debug/runStatus.log"
mode => "tail"
start_position => "beginning"
codec => plain { charset => "Windows-1251" }
sincedb_path => "nul"}

在此先感谢,
文件的整个代码如下所示:

input {
  elasticsearch {
    user => "logstash_internal"
    password => "12341234"
  }
  file {
    type => "pikautotesttc"
    path => "C:/BuildAgent/work/baef4ea7e758f5b8/dms-selenium-tests/TestSelenium/bin/Debug/Logs/**/*.log*"
    mode => "tail"
    start_position => "beginning"
    codec => plain { charset => "Windows-1251" }
    sincedb_path => "nul"
  }
  file {
    type => "runstatus"
    path => "C:/BuildAgent/work/baef4ea7e758f5b8/dms-selenium-tests/TestSelenium/bin/Debug/runStatus.log"
    mode => "tail"
    start_position => "beginning"
    codec => plain { charset => "Windows-1251" }
    sincedb_path => "nul"
  }
  file {
    type => "pikautotesttc12"
    path => "C:/BuildAgent2/work/baef4ea7e758f5b8/dms-selenium-tests/TestSelenium/bin/Debug/Logs/**/*.log*"
    mode => "tail"
    start_position => "beginning"
    codec => plain { charset => "Windows-1251" }
    sincedb_path => "nul"
  }
  file {
    type => "runstatus12"
    path => "C:/BuildAgent2/work/baef4ea7e758f5b8/dms-selenium-tests/TestSelenium/bin/Debug/runStatus.log"
    mode => "tail"
    start_position => "beginning"
    codec => plain { charset => "Windows-1251" }
    sincedb_path => "nul"
  }
}

filter {
  elasticsearch {
    user => "logstash_internal"
    password => "12341234"
  }
  fingerprint {
    source => "message"
    target => "[@metadata][fingerprint]"
    method => "MD5"
    key => "pik"
  }
  if [type] == "runstatus" or [type] == "runstatus12" 
  {
    grok {
        match => {
        "message" => "%{DATESTAMP:date}\s+%{WORD:loglevel}\s+(\[\d+\])?\s+:\s*Сценарий - (?<scenario>.*?)(?=\;)\;\sссылка на контракт - (?<positionUrl>.*)(?=\;)\; попытка \((?<attempt>\d)\/5\) - (?<status>.*)(?=\;)\;\s?(?<screenshot>(.*)?)"
        }
      }
      date {
      match => ["date", "yy-MM-dd HH:mm:ss,SSS"]
      target => "@timestamp"
    }
  }
  if [type] == "pikautotesttc" or [type] == "pikautotesttc12"
  {
      if "URL:" in [message]
    {
      grok {
        match => {
        "message" => "%{DATESTAMP:logdate}\s+%{WORD:loglevel}\s+(\[\d+\])?\s+:\s*%{GREEDYDATA:msgbody}(?= URL: )?( URL: )%{GREEDYDATA:url}(?=\.)\.( User: )?%{GREEDYDATA:user}"
        }
      }
    }
    else
    {
     grok {
        match => {
          "message" => "%{DATESTAMP:logdate}\s+%{WORD:loglevel}\s+(\[\d+\])?\s+:\s*%{GREEDYDATA:msgbody}"
        }
      }
    }
    grok {
      match => { 
        "msgbody" => [
          "Test (?<status>[^&]*)",
          "Время выполнения (контракта|теста) \(первая попытка\): (?<duration>\d+.\d+)"
        ]
      }
      match => {
        "path" => "log\.?(?<attempt>\d)"
      }
      break_on_match => false
    }
    date {
      match => ["logdate", "yy-MM-dd HH:mm:ss,SSS"]
      target => "@timestamp"
    }
    mutate {
      convert => {
        "duration" => "float"
      }
    }
  }
}

output {
  elasticsearch {
    hosts => "localhost:9200"
    manage_template => true
    index => "logstash-%{type}"
    document_id => "%{[@metadata][fingerprint]}"
    user => "logstash_internal"
    password => "12341234"
  }
}
logstash
  • 1 1 个回答
  • 10 Views

1 个回答

  • Voted
  1. Best Answer
    Jacki
    2022-04-15T15:29:37Z2022-04-15T15:29:37Z

    文件形成正确,事实是当ElasticSearch试图接受这个配置文件时,它没有足够的权限在不同的目录中多做几个索引,需要去Kibana => settings => user roles = > 在 Logstash 部分 Writer 中配置,可以在 Logstash => Logs 文件夹中看到错误

    • 0

相关问题

Sidebar

Stats

  • 问题 10021
  • Answers 30001
  • 最佳答案 8000
  • 用户 6900
  • 常问
  • 回答
  • Marko Smith

    表格填充不起作用

    • 2 个回答
  • Marko Smith

    提示 50/50,有两个,其中一个是正确的

    • 1 个回答
  • Marko Smith

    在 PyQt5 中停止进程

    • 1 个回答
  • Marko Smith

    我的脚本不工作

    • 1 个回答
  • Marko Smith

    在文本文件中写入和读取列表

    • 2 个回答
  • Marko Smith

    如何像屏幕截图中那样并排排列这些块?

    • 1 个回答
  • Marko Smith

    确定文本文件中每一行的字符数

    • 2 个回答
  • Marko Smith

    将接口对象传递给 JAVA 构造函数

    • 1 个回答
  • Marko Smith

    正确更新数据库中的数据

    • 1 个回答
  • Marko Smith

    Python解析不是css

    • 1 个回答
  • Martin Hope
    Alexandr_TT 2020年新年大赛! 2020-12-20 18:20:21 +0000 UTC
  • Martin Hope
    Alexandr_TT 圣诞树动画 2020-12-23 00:38:08 +0000 UTC
  • Martin Hope
    Air 究竟是什么标识了网站访问者? 2020-11-03 15:49:20 +0000 UTC
  • Martin Hope
    Qwertiy 号码显示 9223372036854775807 2020-07-11 18:16:49 +0000 UTC
  • Martin Hope
    user216109 如何为黑客设下陷阱,或充分击退攻击? 2020-05-10 02:22:52 +0000 UTC
  • Martin Hope
    Qwertiy 并变成3个无穷大 2020-11-06 07:15:57 +0000 UTC
  • Martin Hope
    koks_rs 什么是样板代码? 2020-10-27 15:43:19 +0000 UTC
  • Martin Hope
    Sirop4ik 向 git 提交发布的正确方法是什么? 2020-10-05 00:02:00 +0000 UTC
  • Martin Hope
    faoxis 为什么在这么多示例中函数都称为 foo? 2020-08-15 04:42:49 +0000 UTC
  • Martin Hope
    Pavel Mayorov 如何从事件或回调函数中返回值?或者至少等他们完成。 2020-08-11 16:49:28 +0000 UTC

热门标签

javascript python java php c# c++ html android jquery mysql

Explore

  • 主页
  • 问题
    • 热门问题
    • 最新问题
  • 标签
  • 帮助

Footer

RError.com

关于我们

  • 关于我们
  • 联系我们

Legal Stuff

  • Privacy Policy

帮助

© 2023 RError.com All Rights Reserve   沪ICP备12040472号-5