研究ELK，新加了臺機器作為fluentd客戶端，fluentd版本為1.2.6，/etc/td-agent/td-agent.conf配置如下：
<source>
@type tail #### tail方式采集日志
path /data/log/nginx/access/test.log ### 日志路徑
format /^(?<remote>[^ ]*) - - \[(?<time_local>[^]]*)\] \[(?<msec>[^]]*)\] (?<request_time>[^ ]*) (?<upstream_response_time>[^ ]*) "(?<method>\S+)(?<path>[^\"]*) \S*" (?<status>[^ ]*) (?<body_bytes_sent>[^ ]*) "(?<http_referer>[^ ]*)" "(?<clientVersion>[^\"]*)" "(?<http_x_forwarded_for>.*)" (?<request_body>[^ ]*) (?<request_params>[^ ]*)$/
types time_local:string,msec:integer,request_time:float,upstream_response_time:float,method:string,path:string,status:integer,body_bytes_sent:integer,http_referer:string,clientVersion:string,request_body:string,request_params:string
tag test.server_product_05
pos_file /data/log/td-agent/task-access.log.pos
time_key time
time_format unixtime
</source>
<match test.**>
@type forward
send_timeout 60s
recover_wait 10s
heartbeat_interval 1s
phi_threshold 16
hard_timeout 60s
<server>
name logserver
host x.x.x.x
port xxxx
</server>
<secondary>
@type file
path /data/log/td-agent/forward-failed
</secondary>
# secondary host is optional
#<secondary>
# host 192.168.0.12
#</secondary>
</match>
客戶端請求日志推送到服務器的日志的 格式為
tag time = 年月日時分秒 record=請求json
因為time的格式不是時間戳，導致日志寫不到elasticsearch中，按照官方檔案配置 time_key time_format都不管用。
先謝謝各位答復。
轉載請註明出處，本文鏈接：https://www.uj5u.com/caozuo/131006.html
標籤：系統維護與使用區
上一篇：Ubuntu