首页 > 代码库 > logstash--使用ngxlog收集windows日志
logstash--使用ngxlog收集windows日志
收集流程 1nxlog => 2logstash => 3elasticsearch
1. nxlog 使用模块 im_file 收集日志文件,开启位置记录功能
2. nxlog 使用模块tcp输出日志
3. logstash 使用input-tcp ,收集日志,并格式化,输出至es
windows上面的nxlog配置文件
nxlog.conf
## This is a sample configuration file. See the nxlog reference manual about the ## configuration options. It should be installed locally and is also available ## online at http://nxlog.org/nxlog-docs/en/nxlog-reference-manual.html ## Please set the ROOT to the folder your nxlog was installed into, ## otherwise it will not start. #define ROOT C:\Program Files\nxlog define ROOT C:\Program Files (x86)\nxlog Moduledir %ROOT%\modules CacheDir %ROOT%\data Pidfile %ROOT%\data\nxlog.pid SpoolDir %ROOT%\data LogFile %ROOT%\data\nxlog.log #<Input in> # Module im_msvistalog # For windows 2003 and earlier use the following: # Module im_mseventlog #</Input> <Input testfile> Module im_file File "C:\\test\\\*.log" SavePos TRUE # Include JSON and raw formats # Exec $Message = to_json() + " " + $raw_event; </Input> <Output out> Module om_tcp Host 10.8.210.29 Port 514 </Output> <Route 1> Path testfile => out </Route>
logstash的启动配置文件
logstash.conf
input { tcp { port => 514 } } filter { json { source => "message" } } output{ elasticsearch { host => "127.0.0.1" port => "9200" protocol => "http" } }
本文出自 “扫榻人” 博客,请务必保留此出处http://enable.blog.51cto.com/747951/1550579
logstash--使用ngxlog收集windows日志
声明:以上内容来自用户投稿及互联网公开渠道收集整理发布,本网站不拥有所有权,未作人工编辑处理,也不承担相关法律责任,若内容有误或涉及侵权可进行投诉: 投诉/举报 工作人员会在5个工作日内联系你,一经查实,本站将立刻删除涉嫌侵权内容。