What are the disadvantages of this logstash configuration file?


(sockaddr_in) #1

I use the redis subscription subscription model, the two machines catalina.out logs are written to a server on the same channel. Then in the output when I wrote a configuration file, the log will be two machines were stored in different documents, how do? The current configuration file is so written, do not know what the problem did not. Under normal circumstances how to deal with it? Also ask, publish and subscribe to the model if the data refresh rate quickly, will lead to data loss, how to solve it?

My goal is to separate the data stored in the same channel to two different files, how to achieve it? I am now so written!

My logstash version:5.0.0
My conf file: (Is there any potential problem with this?)
input{
redis{
host => “abcd.com
port => 6379
data_type => "channel"
key => "internal_catalina_log"
type => "internal_catalina_log"
}
}

filter{
ruby {
code => "
tstamp = event.get('@timestamp').to_i
event.set('date_str', (Time.at(tstamp).getutc-60608).strftime('%Y-%m-%d'))
"
}
}

output{
if [host] == "awsuw21-87.opi.com" { ##### online1_log
file{
path => “./log_backup/catalina_log.%{host}.%{date_str}.log"
codec => line { format => "%{message}" }
}
} else if [host] == "awsuw6-171.opi.com" { #####online2_log
file{
path => “./logstash/logstash-5.0.0/log_backup/catalina_log.%{host}.%{date_str}.log"
codec => line { format => "%{message}" }
}
}
}


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.