logtash 接收多配置文件

[root@10-19-148-59 etc]# vim front_esb.conf

input {
        beats {
          type => beats
          port => 5077
        }
}
filter {
        if [type] == 'test-front' {
            grok {
                overwrite => ['message']
                }
        }
        if [type] == 'test-esb' {
            grok {
                overwrite => ['message']
                }
        }

}
output {
        if [type] == 'test-front' {
        elasticsearch {
           hosts => ["10.19.148.59:9200"]
           index => "test-front-%{+YYYY.MM.dd}"
        }
}
        if [type] == 'test-esb' {
        elasticsearch {
           hosts => ["10.19.148.59:9200"]
           index => "test-esb-%{+YYYY.MM.dd}"
        }
}
}

 我这里的日志采集用的是filebeat 来采集日志的

 

posted @ 2017-04-05 12:43  BigBao的博客  阅读(620)  评论(0编辑  收藏  举报