filebeat过滤

合并多行以[为头

multiline:
pattern: '^\['
negate: true
match: after

------------------------------------------------

过滤掉某行

exclude_lines: ['^#']
----------------------------

# cat filebeat.yml
filebeat.prospectors:
- type: log
  paths:
    - /data/log/tomcat/localhost_access_log.*.txt
  exclude_lines: ['^#']
  fields:
    tag: accesslog-121
- type: log
  paths:
    - /data/log/tomcat/catalina.out
  exclude_lines: ['^#']
  fields:
    tag: catalina-121

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml

  reload.enabled: true
  
output.redis:
  hosts: ["127.0.0.1"]
  port: 6380
  key: "tomcat121-autoschedulecore-access-list"

--------------------------------

包含某行

filebeat.prospectors:
- input_type: log
  paths:
    - /tmp/test.log
  include_lines: [‘error‘]

 

 

---------------------------------------------------------------------------------------------------

filebeat.prospectors:
- type: log
paths:
- /ali/logs/*.out
multiline:
pattern: '^\['
negate: true
match: after
fields:
tag: log1
- type: log
paths:
- /ali/logs/*.conf
fields:
tag: log2
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false

output.redis:
hosts: ["127.0.0.1"]
port: 6380
key: "test-list"