vim /etc/filebeat/filebeat.yml
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 |
#================= Tomcat ================ - input_type: log paths: - /opt/tomcat/logs/catalina.*.log - /opt/tomcat/logs/localhost.*.log document_type: elk-tomcat fields_under_root: true fields.app: "tomcat" multiline: pattern: ^(\w{1,5} \d{1,2}, \d{4} \d{1,2}:\d{1,2}:\d{1,2} \w{1,2}) negate: true match: after - input_type: log paths: - /opt/tomcat/logs/localhost_access_log.*.txt document_type: elk-tomcat fields_under_root: true fields.app: "tomcat" multiline: pattern: (\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3} - - \[\d{1,2}\/\w{1,3}\/\d{1,4}:\d{1,2}:\d{1,2}:\d{1,2} \+\d) negate: true match: after #=============== Tomcat END ============== |