graylog收集mysql慢日誌

# Needed for Graylog

fields_under_root: true

fields.collector_node_id: ${sidecar.nodeName}

fields.gl2_source_collector: ${sidecar.nodeId}

 

filebeat.inputs:

- input_type: log

paths:

- /data/3306/slow.log

type: log

multiline.pattern: '^\# Time: [0-9]{4}-[0-9]{2}-[0-9]{2}'

multiline.negate: true

multiline.match: after

 

output.logstash:

hosts: ["172.16.145.65:5044"]

path:

data: /var/lib/graylog-sidecar/collectors/filebeat/data

logs: /var/lib/graylog-sidecar/collectors/filebeat/log

 

 

 

(?m)^# Time:.*\s+# User@Host: %{USER:user}\[[^\]]+\] @ (?:(?<clienthost>\S*) )?\[(?:%{IP:clientip})?\]\s*Id: %{NUMBER:id}\s+# Query_time: %{NUMBER:query_time}\s+Lock_time: %{NUMBER:lock_time}\s+Rows_sent: %{NUMBER:rows_sent}\s+Rows_examined: %{NUMBER:rows_examined}\s*(?:use %{DATA:database};\s*)?SET timestamp=%{NUMBER:timestamp};\s*(?<query>(?<action>\w+)\s+.*)$