标签:check ast setting code hosts png comm arc iso
LogStash.conf
input { file { type => "iis_log" path => ["C:/inetpub/logs/LogFiles/W3SVC2/u_ex*.log"] } } filter { #ignore log comments if [message] =~ "^#" { drop {} } grok { # check that fields match your IIS log settings match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} (%{IPORHOST:s-ip}|-) (%{WORD:cs-method}|-) %{NOTSPACE:cs-uri-stem} %{NOTSPACE:cs-uri-query} (%{NUMBER:s-port}|-) (%{NOTSPACE:c-username}|-) (%{IPORHOST:c-ip}|-) %{NOTSPACE:cs-useragent} (%{NUMBER:sc-status}|-) (%{NUMBER:sc-win32-status}|-) (%{NUMBER:time-taken}|-)"] } #Set the Event Timesteamp from the log date { match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss" ] timezone => "Etc/UCT" } mutate { remove_field => [ "log_timestamp"] convert => [ "sc-bytes", "float" ] convert => [ "cs-bytes", "float" ] convert => [ "time-taken", "float" ] } mutate { remove_field => [ "log_timestamp"] convert => [ "sc-bytes", "float" ] convert => [ "cs-bytes", "float" ] convert => [ "time-taken", "float" ] } } output { stdout {codec => rubydebug } elasticsearch { hosts => ["localhost:9200"] index => "logstash-%{type}-%{+YYYY.MM.dd}" flush_size => 20000 idle_flush_time => 10 template_overwrite => true } redis { host => ‘127.0.0.1‘ data_type => ‘list‘ key => ‘logstash:redis‘ } }
标签:check ast setting code hosts png comm arc iso
原文地址:http://www.cnblogs.com/HQFZ/p/6249568.html