filebeat合併java日誌多行信息

編輯配置文件
[root@web-bj-docker-10 filebeat]# vim filebeat.yml
#添加以下內容

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- input_type: log                           #默認
  paths:                                    #路徑
    - /mapbar/data/logs/gsmobd.log          #收集的日誌
  document_type: tomcat_gsmobd              #日誌類型，類似標籤，logstash可以按照標籤創建不同索引

#正則匹配以什麼爲開頭
  multiline.pattern: '^\d{4}\-\d{2}\-\d{2}\s\d+\:\d+\:\d+\.\d+\s\[.*\]\sINFO|^\d{4}\-\d{2}\-\d{2}\s\d+\:\d+\:\d+\.\d+\s\[.*\]\sERROR|^\d{4}\-\d{2}\-\d{2}\s\d+\:\d+\:\d+\.\d+\s\[.*\]\sDEBUG|^\d{4}\-\d{2}\-\d{2}\s\d+\:\d+\:\d+\.\d+\s\[.*\]\sWARN'
  multiline.negate: true   #必要參數
  multiline.match: after    #必要參數
  exclude_lines: ['^\d{4}\-\d{2}\-\d{2}\s\d+\:\d+\:\d+\.\d+\s\[.*\]\sINFO','^\d{4}\-\d{2}\-\d{2}\s\d+\:\d+\:\d+\.\d+\s\[.*\]\sDEBUG']    #上面匹配完行，此行爲如果匹配丟棄    
  include_lines: ['^\d{4}\-\d{2}\-\d{2}\s\d+\:\d+\:\d+\.\d+\s\[.*\]\sERROR', '^\d{4}\-\d{2}\-\d{2}\s\d+\:\d+\:\d+\.\d+\s\[.*\]\sWARN']   #此行爲如果匹配通過

#輸出給logstash,也可直接輸出給es
#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
    hosts: ["127.0.0.1:5045"]



logstash配置

[root@web-bj-docker-10 config]# cat logstash.filebeat.conf
只是接收稍作改動，filebeat配置的輸入給logstash5045端口，logstash需要開啓bests模塊，端口爲5045
input {
     beats {
        port => 5045
}
#     file {
#     path => ["/mapbar/data/logs/gsmobd.log"]
#}
}

output{

 stdout { codec => rubydebug }


}