I use the redis subscription subscription model, the two machines catalina.out logs are written to a server on the same channel. Then in the output when I wrote a configuration file, the log will be two machines were stored in different documents, how do? The current configuration file is so written, do not know what the problem did not. Under normal circumstances how to deal with it? Also ask, publish and subscribe to the model if the data refresh rate quickly, will lead to data loss, how to solve it?
My goal is to separate the data stored in the same channel to two different files, how to achieve it? I am now so written!
My logstash version:5.0.0
My conf file: (Is there any potential problem with this?)
input{
redis{
host => “abcd.com”
port => 6379
data_type => "channel"
key => "internal_catalina_log"
type => "internal_catalina_log"
}
}
filter{
ruby {
code => "
tstamp = event.get('@timestamp').to_i
event.set('date_str', (Time.at(tstamp).getutc-60608).strftime('%Y-%m-%d'))
"
}
}
output{
if [host] == "awsuw21-87.opi.com" { ##### online1_log
file{
path => “./log_backup/catalina_log.%{host}.%{date_str}.log"
codec => line { format => "%{message}" }
}
} else if [host] == "awsuw6-171.opi.com" { #####online2_log
file{
path => “./logstash/logstash-5.0.0/log_backup/catalina_log.%{host}.%{date_str}.log"
codec => line { format => "%{message}" }
}
}
}