Logstash IIS日志采集

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

Logstash IIS 日志采集，跟Linux上运行差不多，都需要java运行环境，装个jdk就好了，对于IIS日志暂时未处理X-forward-for，纠结怎么弄当中，貌似要装个插件，慢慢研究。

input {

  file {

    type => "IIS Log"

    path => ["C:/inetpub/logs/LogFiles/W3SVC2/u_ex*.log"]

  }

}

filter {

  grok {

      # check that fields match your IIS log settings

      match => ["message", "%{TIMESTAMP_ISO8601:log_timestamp} %{IPORHOST:site} %{WORD:method} %{URIPATH:page} 

%{NOTSPACE:querystring} %{NUMBER:port} %{NOTSPACE:username} %{IPORHOST:clienthost} %{NOTSPACE:useragent} %{NUMBER:response} 

%{NUMBER:subresponse} %{NUMBER:scstatus} %{NUMBER:time_taken}"]

  }

  #Set the Event Timesteamp from the log

    date {

    match => [ "log_timestamp", "YYYY-MM-dd HH:mm:ss" ]

      timezone => "Etc/UTC"

  }    

  useragent {

    source=> "useragent"

    prefix=> "browser"

  }

  mutate {

    remove_field => [ "log_timestamp"]

  }

}

output {

  stdout {codec => rubydebug }

  redis {

    host => '你的ip地址'

    data_type => 'list'

    key => 'logstash:redis'

  }

}