日志采集器windows客户端的配置释义
<Extension json> Module xm_json </Extension> <Extension charconv> Module xm_charconv AutodetectCharsets GBK #自动检测GBK字符集 并在input中定义 </Extension> <Extension multiline> Module xm_multiline #多行匹配 HeaderLine /^\d+-\w+-\d+/ #行首匹配 </Extension> <Input access> Module im_file File "/home/tomcat/access.log" #定义了采集的日志路径,可支持通配符 SavePos TRUE ReadFromLast TRUE Recursive TRUE RenameCheck TRUE PollInterval 1 Exec convert_fields("AUTO","utf-8"); #表示识别GBK中的字符编码,并转化为UTF8编码 Exec $source = host_ip(); Exec $sourcetype = " tomcat-access"; Exec $app = "WEB"; Exec $filename = file_name(); </Input> <Input catalina> Module im_file File "/home/tomcat/catalina.out" SavePos TRUE ReadFromLast TRUE Recursive TRUE RenameCheck TRUE PollInterval 1 InputType multiline #Exec convert_fields("AUTO","utf-8"); Exec $source = host_ip(); Exec $sourcetype = "tomcat-catalina"; Exec $app = "WEB"; Exec $filename = file_name(); </Input> <Output loginsight_access> Module om_tcp Host 192.168.11.196 Port 1516 Exec sleep (1000); Exec $message = $raw_event;to_json(); </Output> <Output loginsight_catalina> Module om_tcp Host 192.168.11.196 Port 1517 Exec sleep (1000); Exec $message = $raw_event;to_json(); </Output> <Route 1> Path access => loginsight_access </Route> <Route 2> Path catalina => loginsight_catalina </Route>