(1)

filebeat.PRospectors:

- input_type: log

  paths:

    - /log/abcbillserver.log

    #- /home/haoren/data/filebeat-5.0.2-linux-x86_64/test.log

  encoding: gbk

  symlinks: true

  include_lines: ['/[.*?統計/]','/[.*?結算/]']

  document_type: billbijiesuan

  fields_under_root: true

  fields:

    host: 192.168.10.7

processors:

- drop_fields:

    #fields: ["beat.hostname", "beat.name", "beat.version", "input_type", "beat"]

    fields: ["input_type", "beat", "offset", "source"]

output.redis:

  enabled: true

  hosts: ["192.168.10.8"]

  passWord: "A8841c09BAD52E63067C4DA"

  port: 6379

  datatype: list

  key: "filebeat"

  db: 0

output.file:

  enabled: false

  path: "/tmp/filebeat"

output.console:

  enabled: false

(2)

filebeat.prospectors:

- input_type: log

  paths:

    - /log/cactivityserver.log

    #- /home/haoren/data/filebeat-5.0.2-linux-x86_64/test.log

  encoding: gbk

  symlinks: true

  include_lines: ['/[.*?統計/]','/[.*?結算/]']

  document_type: activityserver

  fields_under_root: true

  fields:

    host: 192.168.10.13

- input_type: log

  paths:

    - /log/fvchannelserver.log

    #- /home/haoren/data/filebeat-5.0.2-linux-x86_64/test.log

  encoding: gbk

  symlinks: true

  include_lines: ['/[.*?統計/]','/[.*?結算/]']

  document_type: vchannelserver

  fields_under_root: true

  fields:

    host: 192.168.10.13

processors:

- drop_fields:

    #fields: ["beat.hostname", "beat.name", "beat.version", "input_type", "beat"]

    fields: ["input_type", "beat", "offset", "source"]

output.redis:

  enabled: true

  hosts: ["192.168.10.8"]

  password: "A8841c09BAD52E63067C4DA"

  port: 6379

  datatype: list

  key: "filebeat"

  db: 0

output.file:

  enabled: false

  path: "/tmp/filebeat"

output.console:

  enabled: false

logstash.conf 如下

input {

  redis {

    host => ["192.168.10.8"]

    port => 6379

    password => "A8841c09BAD52E63067C4DA"

    data_type => "list"

    key => "logstash"

    codec => json {

      charset => "UTF-8"

    }

  }

}

filter {

    ruby {

        code=>"event.set('daytag',event.timestamp.time.localtime.strftime('%Y.%m.%d'))"

    }

}

output {

  elasticsearch {

    hosts => ["127.0.0.1:19200"]

    index => "%{type}-%{daytag}"

    #index => "%{type}-%{+yyyy.MM.dd}"

    user => "logstashserver"

    password => "A950C0FB2D833E42C1AC59210CD5CDF8"

  }

}