發送slowlogs到.csv文件？

我正在使用logstash 2.4.0和logstash 2.4.0 我想使用logstash將slowlogs發送到.csv輸出文件。我的配置文件是這樣的發送slowlogs到.csv文件？

 input { 
    file { 
    path => "D:\logstash-2.4.0\logstash-2.4.0\bin\rachu.log" 
    start_position => "beginning" 
    } 
} 

filter { 
    grok { 
     match => [ "message", 

"\[%{TIMESTAMP_ISO8601:TIMESTAMP}\]\[%{LOGLEVEL:LEVEL}%{SPACE}\]\[%{DATA:QUERY}\]%{SPACE}\[%{DATA:QUERY1}\]%{SPACE}\[%{DATA:INDEX-NAME}\]\[%{DATA:SHARD}\]%{SPACE}took\[%{DATA:TOOK}\],%{SPACE}took_millis\[%{DATA:TOOKM}\], types\[%{DATA:types}\], stats\[%{DATA:stats}\],search_type\[%{DATA:search_type}\], total_shards\[%{NUMBER:total_shards}\], source\[%{DATA:source_query}\], extra_source\[%{DATA:extra_source}\],"] 
    } 
} 
output { 
    csv { 
     fields => ["TIMESTAMP","LEVEL","QUERY","QUERY1","INDEX-NAME","SHARD","TOOK","TOOKM","types","stats","search_type","total_shards","source_query","extra_source"] 
     path => "D:\logstash-2.4.0\logstash-2.4.0\bin\logoutput.csv" 
     spreadsheet_safe => false 
    } 

}

來源

2017-01-16 Seeker

csv過濾器在您的上下文中沒有用處。它的目標是解析傳入的CSV數據，但這不是你所擁有的。你需要的是先解析與grok過濾日誌線，只有這樣，你就可以正確地將其發送至csv輸出：

filter { 
    grok { 
     match => {"message" => "\[%{TIMESTAMP_ISO8601:TIMESTAMP}\]\[%{LOGLEVEL:LOGLEVEL} \]\[%{DATA:QUERY}\] \[%{WORD:QUERY1}\] \[%{WORD:INDEX}\]\[%{INT:SHARD}\] took\[%{BASE10NUM:TOOK}ms\], took_millis\[%{BASE10NUM:took_millis}\], types\[%{DATA:types}\], stats\[%{DATA:stats}\], search_type\[%{DATA:search_type}\], total_shards\[%{INT:total_shards}\], source\[%{DATA:source}\], extra_source\[%{DATA:extra_source}\]"} 
    } 
} 
output { 
    csv { 
     fields => ["TIMESTAMP","LOGLEVEL","QUERY","QUERY1","INDEX-NAME","SHARD","TOOK","took_millis","types","stats","search_type","total_shards","source_query","extra_source"] 
     path => "F:\logstash-5.1.1\logstash-5.1.1\finaloutput1" 
     spreadsheet_safe => false 
    } 
}

注：這還不能在Logstash 5.1工作。 1因爲this open issue。它應該儘快得到解決，但同時它適用於Logstash 2.4。

來源

2017-01-17 03:51:11 Val

爲了社區的利益，您是否能夠完成這項工作，或者您是否還有其他問題？這是一個很好的做法，讓人們知道一個答案是否符合你的需求，如果是，接受它。 – Val

是的，它完全符合我在logstash 2.4.0中的需求，並且我也接受了它。 – Seeker

當我接受它顯示'感謝您的反饋意見，那些少於15聲譽的投票記錄，但不改變公開顯示的帖子得分' – Seeker

發送slowlogs到.csv文件？

回答

相關問題