Install elk7 with login password for elk (practice brother tutorial), use logstash built-in grok regular analysis to analyze nginx and httpd

 

The elk version is 7.7 The system version is centos7, see the tutorial: https://blog.csdn.net/yuezhilangniao/article/details/112691680

Two confs, one is tomcat log

input{
	file {
        path => ["/home/tomcat8/tomcat_8005/logs/catalina.out"]
        start_position => "beginning"
	    }
	file {
        path => ["/home/tomcat8/tomcat_8006/logs/catalina.out"]
        start_position => "beginning"
	    }
}

filter{
#[2020-12-31 15:10:00.660][INFO][cn.com.hyundai.mms.component.ons.producer.ONSProducerHandler]消息内容：TopicMessage{Properties:{KEYS=MessageKey}messageTag='insToSaaS', receiptHandle='null'}
grok {
		match => { 
		"message" => " \[%{DATA:timestamp}\]\[%{WORD:verb}\]\[%{URIPROTO:request}\]
		" }
	}
}


output{
	elasticsearch {
    		hosts => ["http://10.69.15.56:9200"]
    		user => "elastic"
    		password => "123456"
    		index => "hml_8089_0506_catalina_out-%{+YYYY.MM.dd}"
	  }

}

 

One is httpd log

input {
    file {
        path => ["/var/log/httpd/access_log"]
        start_position => "beginning"
    }
 }

filter {
	 grok {
     	   	match => { "message" => "%{COMMONAPACHELOG:apachelog}" }
        	add_field => [ "response", "%{NUMBER:response}" ]
    }

}

output {
	
	 elasticsearch {
    		hosts => ["http://10.69.15.56:9200"]
    		user => "elastic"
    		password => "123456"
    		index => "sjghttpd_access-%{+YYYY.MM.dd}"
  }
}

The built-in httpd regularity of grok comes from the article: https://blog.csdn.net/aca_jingru/article/details/44647519