单片购买,影视豆记录

admin

2021-04-17 9182b5ddc029d28dd5adf563958d07fc76c63123

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
#Sample Logstash configuration for creating a simple
# Beats - > Logstash - > Elasticsearch pipeline.
 
input {
    beats {
        port => 5044
    }
}
 
filter {
 
    ruby {
        code => "event.set('timestamp', event.get('@timestamp').time.localtime + 8*60*60)"
    }
    ruby {
        code => "event.set('@timestamp',event.get('timestamp'))"
    }
    if [fields][app] == "buwan" {
        if [fields][type] == "videoPlay" {
            grok {
                match => {
                    "message" =>
                    "%{TIMESTAMP_ISO8601:time}\s*\[%{DATA:thread}\]\s*%{LOGLEVEL:logLevel}\s*%{WORD:logName}\s*-\s*%{WORD:method}\:%{NUMBER:detailSystemId}#%{NUMBER:videoId}#"
                }
            }
 
            mutate {
                remove_field => ["message"]
                remove_field => ["input"]
                remove_field => ["tags"]
                remove_field => ["meta"]
                remove_field => ["host"]
                remove_field => ["timestamp"]
            }
        }
        if [fields][type] == "videoPlayUser" {
            grok {
                match => {
                    "message" =>
                    "%{TIMESTAMP_ISO8601:time}\s*\[%{DATA:thread}\]\s*%{LOGLEVEL:logLevel}\s*%{WORD:logName}\s*-\s*%{WORD:method}\:%{UUID:device}#(?<utdId>([\S+]*))#(?<loginUid>([0-9]*))#%{NUMBER:detailSystemId}#%{NUMBER:videoId}#%{NUMBER:resourceId}#(?<from>([\S+]*))"
                }
            }
 
            mutate {
                remove_field => ["message"]
                remove_field => ["input"]
                remove_field => ["tags"]
                remove_field => ["meta"]
                remove_field => ["host"]
                remove_field => ["timestamp"]
            }
 
        }
        if [fields][type] == "userActive" {
            grok {
                match => {
                    "message" =>
                    "%{TIMESTAMP_ISO8601:time}\s*\[%{DATA:thread}\]\s*%{LOGLEVEL:logLevel}\s*%{WORD:logName}\s*-\s*%{NUMBER:detailSystemId}#%{NUMBER:version}#%{UUID:device}#(?<utdId>([\S+]*))#(?<loginUid>([0-9]*))#%{WORD:type}#(?<params1>([\S+]*))#(?<params2>([\S+]*))#(?<params3>([\S+]*))"
                }
            }
 
            mutate {
                remove_field => ["message"]
                remove_field => ["input"]
                remove_field => ["tags"]
                remove_field => ["meta"]
                remove_field => ["host"]
                remove_field => ["timestamp"]
            }
 
        }
    }
}
 
output {
    if [fields][app] == "buwan" {
        if [fields][type] == "videoPlay" {
            file {
                path => "D:/logs/buwan/videoplay/%{+yyyy}_%{+MM}_%{+dd}.log"
            }
            
        } else if [fields][type] == "videoPlayUser" {
            file {
                path => "D:/logs/buwan/videoplay-user/%{+yyyy}_%{+MM}_%{+dd}.log"
            }
        } else if [fields][type] == "userActive" {
            file {
                path => "D:/logs/buwan/user/active_%{+yyyy}_%{+MM}_%{+dd}.log"
            }
        } else if [fields][type] == "error" {
            file {
                path => "D:/logs/buwan/error/%{+yyyy}_%{+MM}_%{+dd}.log"
            }
        } else if [fields][type] == "videoUpdate" {
            file {
                path => "D:/logs/buwan/video_update/%{+yyyy}_%{+MM}_%{+dd}.log"
            }
        }
    }
}