Logstash - 過濾器

Logstash 在輸入和輸出之間的管道中使用過濾器。Logstash 過濾器的度量用於操控和建立諸如 Apache-Access 之類的事件。許多過濾器外掛用於管理 Logstash 中的事件。在此，在 Logstash 聚集過濾器的一個示例中，我們正在篩選資料庫中每個 SQL 事務的持續時間並計算總時間。

安裝聚集過濾器外掛

使用 Logstash-plugin 實用程式安裝聚集過濾器外掛。Logstash-plugin 是 Logstash 中 bin 資料夾中用於 Windows 的批處理檔案。

>logstash-plugin install logstash-filter-aggregate

logstash.conf

在該配置中，你可以看到三個“if”語句，用於初始化、增量和生成事務的總持續時間，即 sql_duration。聚集外掛用於新增輸入日誌中的每個事件中存在的 sql_duration。

input {
   file {
      path => "C:/tpwork/logstash/bin/log/input.log"
   }
} 
filter {
   grok {
      match => [
         "message", "%{LOGLEVEL:loglevel} - 
            %{NOTSPACE:taskid} - %{NOTSPACE:logger} - 
            %{WORD:label}( - %{INT:duration:int})?" 
      ]
   }
   if [logger] == "TRANSACTION_START" {
      aggregate {
         task_id => "%{taskid}"
         code => "map['sql_duration'] = 0"
         map_action => "create"
      }
   }
   if [logger] == "SQL" {
      aggregate {
         task_id => "%{taskid}"
         code => "map['sql_duration'] ||= 0 ;
            map['sql_duration'] += event.get('duration')"
      }
   }
   if [logger] == "TRANSACTION_END" {
      aggregate {
         task_id => "%{taskid}"
         code => "event.set('sql_duration', map['sql_duration'])"
         end_of_task => true
         timeout => 120
      }
   }
}
output {
   file {
      path => "C:/tpwork/logstash/bin/log/output.log"    
   }
}

執行 Logstash

我們可以使用以下命令執行 Logstash。

>logstash –f logstash.conf 

input.log

以下程式碼塊顯示輸入日誌資料。

INFO - 48566 - TRANSACTION_START - start
INFO - 48566 - SQL - transaction1 - 320
INFO - 48566 - SQL - transaction1 - 200
INFO - 48566 - TRANSACTION_END - end

output.log

如配置檔案中指定的那樣，記錄器為 TRANSACTION_END 的最後一個“if”語句，它列印總事務時間或 sql_duration。這已在 output.log 中用黃色突出顯示。

{
   "path":"C:/tpwork/logstash/bin/log/input.log","@timestamp": "2016-12-22T19:04:37.214Z",
   "loglevel":"INFO","logger":"TRANSACTION_START","@version": "1","host":"wcnlab-PC",
   "message":"8566 - TRANSACTION_START - start\r","tags":[]
}
{
   "duration":320,"path":"C:/tpwork/logstash/bin/log/input.log",
   "@timestamp":"2016-12-22T19:04:38.366Z","loglevel":"INFO","logger":"SQL",
   "@version":"1","host":"wcnlab-PC","label":"transaction1",
   "message":" INFO - 48566 - SQL - transaction1 - 320\r","taskid":"48566","tags":[]
}
{
   "duration":200,"path":"C:/tpwork/logstash/bin/log/input.log",
   "@timestamp":"2016-12-22T19:04:38.373Z","loglevel":"INFO","logger":"SQL",
   "@version":"1","host":"wcnlab-PC","label":"transaction1",
   "message":" INFO - 48566 - SQL - transaction1 - 200\r","taskid":"48566","tags":[]
}
{
   "sql_duration":520,"path":"C:/tpwork/logstash/bin/log/input.log",
   "@timestamp":"2016-12-22T19:04:38.380Z","loglevel":"INFO","logger":"TRANSACTION_END",
   "@version":"1","host":"wcnlab-PC","label":"end",
   "message":" INFO - 48566 - TRANSACTION_END - end\r","taskid":"48566","tags":[]
}