點擊右邊

你頭疼的雄厚娛樂城ELK困難,本文幾近都辦理了

 
1、ELK適用學問點總結
一、編碼轉換成績
這個成績,首要便是中文亂碼。
input中的codec=>plain轉碼:

  1. codec => plain { 
  2.          charset => "GB2312" 

將GB2312的文本編碼,轉為UTF-8的編碼。
也能夠在filebeat中完電競運彩分析成編碼的轉換(保舉):

  1. filebeat.prospectors: 
  2. – input_type: log 
  3.   paths: 
  4.     – c:\Users\Administrator\Desktop\performanceTrace.txt 
  5.   encoding: GB2312 

2、刪除過剩日記中的過剩行

  1. if ([message] =~ "^20.*-\ task\ request,.*,start\ time.*") { &nb玩運彩sp; #用正則需刪除的過剩行 
  2.             drop {} 
  3.     }  

日記示例:

  1. 2018-03-20 10:44:01,523 [33]DEBUG Debug – task request,task Id:1cbb72f1-a5ea-4e73-957c-6d20e9e12a7a,start time:2018-03-20 10:43:59   #需刪除的行 
  2. — Request String :  
  3. {"UserName":"15046699923","Pwd":"ZYjyh727","DeviceType":2,"DeviceId":"PC-20170525SADY","EquipmentNo":null,"SSID":"pc","RegisterPhones":null,"AppKey":"ab09d78e3b2c40b789ddfc81674bc24deac","Version":"2.0.5.3"} — End 
  4. — Response String :  
  5. {"ErrorCode":0,"Success":true,"ErrorMsg":null,"Result":null,"WaitInterval":30} — End 

三、grok處置多種日記不同的行
日記示例:

  1. 2018-03-20 10:44:01,523 [33]DEBUG Debug – task request,task Id:1cbb72f1-a5ea-4e73-957c-6d20e9e12a7a,start time:2018-03-20 10:43:59 
  2. — Request String :  
  3. {"UserName":"15046699923","Pwd":"ZYjyh727","DeviceType":2,"DeviceId":"PC-20170525SADY","EquipmentNo":null,"SSID":"pc","Registeq8娛樂城rPhones":null,"AppKey":"ab09d78e3b2c40b789ddfc81674bc24deac","Version":"2.0大樂透即時開獎號碼.5.3"} — End 
  4. — Response String :  
  5. {"ErrorCode":0,"Success&線上真人麻將推薦quot;:true,"ErrorMsg":null,"Result":null,"WaitInterval":30} — End 

在logstash filter中grok分手處置3行:

  1. match => { 
  2.     "message" => "^20.*-\ task\ request,.*,start\ time\:%{TIMESTAMP_ISO8601:RequestTime}" 
  3. match => { 
  4.     "message" => "^–\ Request\ String\ :\ \{\"UserName\":\"%{NUMBER:UserName:int}\",\"Pwd\":\"(?<Pwd>.*)\",\"DeviceType\":%{NUMBER:DeviceType:int},\"DeviceId\":\"(?<DeviceId>.*)\",\"EquipmentNo\":(?<EquipmentNo>.*),\"SSID\":(?<SSID>.*),\"RegisterPhones\":(?<RegisterPhones>.*),\"AppKey\":\"(?<AppKey>.*)\",\"Version\":\"(?<Version>.*)\"\}\ –\ \End.*"     
  5. match => { 
  6.     "message" => "^–\ Response\ String\ :\ \{\"ErrorCode\":%{NUMBER:ErrorCode:int},\"Success\":(?<Success>[a-z]*),\"ErrorMsg\":(?<ErrorMsg>.*),\"Result\":(?<Result>.*),\"WaitInterval\":%{NUMBER:WaitInterval:int}\}\ –\ \End.*" 
  7. … 等多行 

四、日記多行歸并處置—multiline插件(重點)
示例:
①日記

  1. 2018-03-20 10:44:01,523 [33]DEBUG Debug – task request,task Id:1cbb72f1-a5ea-4e73-957c-6d20e9e12a7a,start time:2018-03-20 10:43:59 
  2. — Request String :  
  3. {"UserName":"15046699923","Pwd":"ZYjyh727","DeviceType":2,"DeviceId":"PC-20170525SADY","EquipmentNo":null,"SSID":"pc","RegisterPhones":null,"AppKey":"ab09d78e3b2c40b789ddfc81674bc24deac","Version":"2.0.5.3"} — End 
  4. — Response String :  
  5. {"ErrorCode":0,"Success":true,&威力彩開獎直播quot;ErrorMsg":null,"Result":null,"WaitInterval":30} — End 

【免責聲明】本站內容轉載自互聯網,其相關談吐僅代表作者小我私家概念盡非權勢巨子,不代表本站態度。如您發明內容存在版權成績,請提交相關鏈接至郵箱:,咱們將實時予以處置。