From 4b86cf6bbe5a7204a801169398fa836e8e06c109 Mon Sep 17 00:00:00 2001
From: guoshilong <123456>
Date: Wed, 14 Dec 2022 17:04:36 +0800
Subject: [PATCH] Merge remote-tracking branch 'refs/remotes/origin/master'

---
 doc/script/docker/elk/logstash-filebeat.conf |   23 +++++++++++++++++++++++
 1 files changed, 23 insertions(+), 0 deletions(-)

diff --git a/doc/script/docker/elk/logstash-filebeat.conf b/doc/script/docker/elk/logstash-filebeat.conf
new file mode 100644
index 0000000..3c2938f
--- /dev/null
+++ b/doc/script/docker/elk/logstash-filebeat.conf
@@ -0,0 +1,23 @@
+input {
+    # 来源beats
+    beats {
+        # 端口
+        port => "5044"
+    }
+}
+# 分析、过滤插件，可以多个
+filter {
+    grok {
+        match => { "message" => "%{COMBINEDAPACHELOG}"}
+    }
+    geoip {
+        source => "clientip"
+    }
+}
+output {
+    # 选择elasticsearch
+    elasticsearch {
+        hosts => ["http://es-master:9200"]
+        index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
+    }
+}

--
Gitblit v1.9.3