logstash tomcat catalina.out zabbix 插件不会引起崩溃

input {
        file {
                type => "zj_api"
                path => ["/data01/applog_backup/zjzc_log/zj-api*catalina*"]
        }
    
       file { 
                type => "wj_api" 
                path => ["/data01/applog_backup/winfae_log/wj-api*catalina*"] 
        } 

 
}

 filter {
    multiline {  
   pattern => "^s+%{TIMESTAMP_ISO8601}"
  negate=>true  
  what=>"previous"  
 }  
         mutate {
                       add_field => [ "[@metadata][zabbix_key]" , "logstash-api-access" ]
                       add_field => [ "[@metadata][zabbix_host]" , "dr-mysql01" ]
                       add_field =>["messager","%{type}-%{message}"]
                       remove_field =>["message"]
                }


    }

filter {
    grok {
        match => [ "messager","(?m)s*%{TIMESTAMP_ISO8601:time}s+(?<Level>(S+)).*"]
     }
     date {
        match => ["time", "yyyy-MM-dd HH:mm:ss,SSS"]
    }
}

output {
         if ([Level]  == "ERROR" or [messager] =~ "Exception" ) and [messager] !~ "温金服务未连接" {
          zabbix {
		zabbix_host => "[@metadata][zabbix_host]"
		zabbix_key => "[@metadata][zabbix_key]"
        zabbix_server_host => "192.168.32.55"
        zabbix_server_port => "10051"
		zabbix_value => "messager"
        }
       }
     if [type] == "zj_api" { 
        redis {
                host => "192.168.32.67"
                data_type => "list"
                key => "zj_api:redis"
                port=>"6379"
                password => "1234567"
        }
}
      else if [type] == "wj_api"{
       redis { 
                host => "192.168.32.67" 
                data_type => "list" 
                key => "wj_api:redis" 
                port=>"6379" 
                password => "1234567" 
        } 
}
}
 
 
 
 
{
      "@version" => "1",
    "@timestamp" => "2016-09-22T13:06:58.392Z",
          "path" => "/data01/applog_backup/zjzc_log/zj-api01-catalina.out.2016-09-22",
          "host" => "dr-mysql01.zjcap.com",
          "type" => "zj_api",
          "tags" => [
        [0] "multiline",
        [1] "_grokparsefailure"
    ],
      "messager" => "zj_api- yrywqrq23423423432"
}


{
      "@version" => "1",
    "@timestamp" => "2016-09-22T13:08:30.770Z",
          "path" => "/data01/applog_backup/zjzc_log/zj-api01-catalina.out.2016-09-22",
          "host" => "dr-mysql01.zjcap.com",
          "type" => "zj_api",
      "messager" => "zj_api- 2016-09-22 21:08:30,770 INFO com.zjzc.common.utils.HttpUtil - 请求参数: ",
          "time" => "2016-09-22 21:08:30,770",
         "Level" => "INFO"
}
{
      "@version" => "1",
    "@timestamp" => "2016-09-22T13:08:30.839Z",
          "path" => "/data01/applog_backup/zjzc_log/zj-api01-catalina.out.2016-09-22",
          "host" => "dr-mysql01.zjcap.com",
          "type" => "zj_api",
      "messager" => "zj_api- 2016-09-22 21:08:30,839 INFO com.zjzc.common.utils.HttpUtil - 请求接口: https://www.zjcap.cn/pay/interface/bankchannellist, 耗时=-68 ",
          "time" => "2016-09-22 21:08:30,839",
         "Level" => "INFO"
}

这种情况下,即使匹配不上 也不会造成logstash zabbix插件崩掉

原文地址:https://www.cnblogs.com/hzcya1995/p/13350228.html