Linux-Syslog

客户端rsyslog 配置文件。

在最低端加入

 

 

$template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"

 

:programname, startswith, "spice-vdagent"   /var/log/spice-vdagent.log;SpiceTmpl

 

*.* @192.168.0.66:514

 

 服务器端rsyslog 配置文件

 

去掉

$ModLoad imudp

$UDPServerRun 514

前的注释

在#### GLOBAL DIRECTIVES ####  下加入

$template IpTemplate,"/var/log/%FROMHOST-IP%.log"

*.*  ?IpTemplate

& ~

 

在最低端加入

$template SpiceTmpl,"%TIMESTAMP%.%TIMESTAMP:::date-subseconds% %syslogtag% %syslogseverity-text%:%msg:::sp-if-no-1st-sp%%msg:::drop-last-lf%\n"

#  

:programname, startswith, "spice-vdagent"<span style="white-space:pre">   </span>/var/log/spice-vdagent.log;SpiceTmpl

 

•     

logstash  创建agent脚本

 

 

input {

  syslog{

  # host =>"192.168.0.66"

   port =>5514

 

  }

 file {

    path => [ "/var/log/*.log", "/var/log/messages", "/var/log/syslog", "/var/log/aaa.log","/var/log/lastlog"]

    type => "syslog"

  }

}

 

output {

  elasticsearch {

    hosts =>["192.168.0.66:9200"]

   }

  stdout { codec => rubydebug }

}

 

filter {

  if [type] == "syslog" {

    grok {

      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }

      add_field => [ "received_at", "%{@timestamp}" ]

      add_field => [ "received_from", "%{host}" ]

    }

    syslog_pri { }

    date {

      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]

    }

  }

}

 

启动log