<pre name="code" class="html">input { file { type => "zj_mysql" path => ["/data01/applog_backup/zjzc_log/zj-mysql01-slowlog.*"] } file { type => "wj_mysql" path => ["/data01/applog_backup/winfae_log/wj-mysql01-slowlog.*"] } } filter { multiline { pattern =>"^s+#s+Time:" negate=>true what=>"previous" } } output { if [type] == "zj_mysql" { redis { host => "192.168.32.67" data_type => "list" key => "zj_mysql:redis" port=>"6379" password => "1234567" } } else if [type] == "wj_mysql"{ redis { host => "192.168.32.67" data_type => "list" key => "wj_mysql:redis" port=>"6379" password => "1234567" } } } multiline 多行匹配: 这个插件很简单,就是把当前行的数据添加到前面一行后面,直到新进的当前行匹配^# Time:正则为止。 看下slow log日志; LIMIT 0, 50; # Time: 160826 14:56:36 # User@Host: zjzc_dba[zjzc_dba] # Query_time: 8.897828 Lock_time: 0.000263 Rows_sent: 1 Rows_examined: 25721574 SET timestamp=1472194596; SELECT (SUM(repay.`yieldBalance`)-SUM(TRUNCATE(holding.`investBalance`*stock.productYield*pr.duration/pr.daysOfYear,pr.`precision`))) AS totalAddBenefit FROM GambleStockIndex stock INNER JOIN `Product` po ON po.sn = stock.productSn INNER JOIN ProductRepay pr on po.sn = pr.productSn INNER JOIN `ClientInvestOrder` co ON co.`orderNo` = stock.`orderNo` INNER JOIN `ClientProductHolding` holding ON holding.`investSn` = co.`sn` INNER JOIN `ProductRepayment` repay ON repay.`holdingSn` = holding.`sn` WHERE stock.`status`=2 and po.status =5 LIMIT 0, 50; # Time: 160826 15:17:06 # User@Host: zjzc_dba[zjzc_dba] @ [115.236.160.83] Id: 5534343 # Query_time: 8.842579 Lock_time: 0.000178 Rows_sent: 1 Rows_examined: 25721574 SET timestamp=1472195826; SELECT (SUM(repay.`yieldBalance`)-SUM(TRUNCATE(holding.`investBalance`*stock.productYield*pr.duration/pr.daysOfYear,pr.`precision`))) AS totalAddBenefit FROM GambleStockIndex stock INNER JOIN `Product` po ON po.sn = stock.productSn INNER JOIN ProductRepay pr on po.sn = pr.productSn INNER JOIN `ClientInvestOrder` co ON co.`orderNo` = stock.`orderNo` INNER JOIN `ClientProductHolding` holding ON holding.`investSn` = co.`sn` INNER JOIN `ProductRepayment` repay ON repay.`holdingSn` = holding.`sn` WHERE stock.`status`=2 and po.status =5 LIMIT 0, 50;