使用kibana可视化报表实时监控你的应用程序，从日志中找出问题，解决问题 - 一线码农 - 博客园

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.



################## 1. IntelligentMarketing.Service3  ##################
- 
  enabled: true
  paths:
    D:\Services\channel3\log\*.log
  exclude_lines: ['^----------','重新排队，暂停 100。$']
  fields:
    appname: IntelligentMarketing.Service3
    ipnet: 10.153.204.199
    ippub: 121.41.176.41
  encoding: gbk
  multiline.pattern: ^(\s|[A-Z][a-z]|-)
  multiline.match: after


################## 2. IntelligentMarketing.Service4  ##################
- 
  enabled: true
  paths:
    D:\Services\channel4\log\*.log
  exclude_lines: ['^----------','重新排队，暂停 100。$']
  fields:
    appname: IntelligentMarketing.Service4
    ipnet: 10.153.204.199
    ippub: 121.41.176.41
  encoding: gbk
  multiline.pattern: ^(\s|[A-Z][a-z]|-)
  multiline.match: after

2017-11-13 00:00:36,904 [65] ERROR [xxx.Monitor.Worker:83] Tick [(null)] - 这是一些测试数据。。

match => { "message" => "%{TIMESTAMP_ISO8601:logdate} \[%{NUMBER:threadId}\] %{LOGLEVEL:level}"}

input {
    beats {
       port => 5044
    }
}

filter {
    grok {
          match => { "message" => "%{TIMESTAMP_ISO8601:logdate} \[%{NUMBER:threadId}\] %{LOGLEVEL:level}"}
    }
    if ([message] =~ "^----------") {
      drop {}
    }
    date {
        match => ["logdate", "yyyy-MM-dd HH:mm:ss,SSS"]
      # target => "@timestamp"
        timezone => "Asia/Shanghai"
    }
    ruby {
       code => "event.timestamp.time.localtime"
    }
}

output {
  stdout {
   codec => rubydebug { }
  }

   elasticsearch {
       hosts => "10.132.166.225"
       index => "log-%{+YYYY.MM.dd}"
   }
  
}　　　　　　　

htpasswd -bc /data/myapp/nginx/conf/htpasswd.users damin  abcdefg

server {
        listen       80;
        server_name  localhost;

        #charset koi8-r;
        #access_log  logs/host.access.log  main;

       auth_basic "Restricted Access";
       auth_basic_user_file /data/myapp/nginx/conf/htpasswd.users;      #登录验证
       location / {

           proxy_pass http://10.122.166.225:5601;     #转发到kibana
           proxy_http_version 1.1;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection 'upgrade';
           proxy_set_header Host $host;
           proxy_cache_bypass $http_upgrade;
           allow 222.68.71.185;  #允许的IP
           allow 118.133.47.76; #允许的IP
           deny all;
       }

[root@localhost conf]# /data/myapp/nginx/sbin/nginx -s reload