0
点赞
收藏
分享

微信扫一扫

ELK LOGSTASH MySQL慢日志的展示

由于MySQL的慢日志查询格式比较特殊,所以需要用正则进行匹配,并使用multiline能够进行多行匹配(看具体配置)

由于MySQL的慢日志查询格式比较特殊,所以需要用正则进行匹配,并使用multiline能够进行多行匹配(看具体配置)
input {
file {
path => "/var/log/messages"
type => "system"
start_position => "beginning"
}

file {
path => "/var/log/secure"
type => "secure"
start_position => "beginning"
}

file {
path => "/var/log/httpd/access_log"
type => "http"
start_position => "beginning"
}

file {
path => "/usr/local/nginx/logs/elk.access.log"
type => "nginx"
start_position => "beginning"
}

file {
path => "/var/log/mysql/mysql.slow.log"
type => "mysql"
start_position => "beginning"
codec => multiline {
pattern => "^# User@Host:"
negate => true
what => "previous"
}
}
}

filter {

grok {
match => { "message" => "SELECT SLEEP" }
add_tag => [ "sleep_drop" ]
tag_on_failure => []
}


if "sleep_drop" in [tags] {
drop {}
}

grok {
match => { "message" => "(?m)^# User@Host: %{USER:User}\[[^\]]+\] @ (?:(?<clienthost>\S*) )?\[(?:%{IP:Client_IP})?\]\s.*# Query_time: %{NUMBER:Query_Time:float}\s+Lock_time: %{NUMBER:Lock_Time:float}\s+Rows_sent: %{NUMBER:Rows_Sent:int}\s+Rows_examined: %{NUMBER:Rows_Examined:int}\s*(?:use %{DATA:Database};\s*)?SET timestamp=%{NUMBER:timestamp};\s*(?<Query>(?<Action>\w+)\s+.*)\n# Time:.*$" }
}

date {
match => [ "timestamp", "UNIX" ]
remove_field => [ "timestamp" ]
}


}



output {

if [type] == "system" {

elasticsearch {
hosts => ["192.168.1.202:9200"]
index => "nagios-system-%{+YYYY.MM.dd}"
}
}

if [type] == "secure" {

elasticsearch {
hosts => ["192.168.1.202:9200"]
index => "nagios-secure-%{+YYYY.MM.dd}"
}
}

if [type] == "http" {

elasticsearch {
hosts => ["192.168.1.202:9200"]
index => "nagios-http-%{+YYYY.MM.dd}"
}
}

if [type] == "nginx" {

elasticsearch {
hosts => ["192.168.1.202:9200"]
index => "nagios-nginx-%{+YYYY.MM.dd}"
}
}

if [type] == "mysql" {

elasticsearch {
hosts => ["192.168.1.202:9200"]
index => "nagios-mysql-slow-%{+YYYY.MM.dd}"
}
}
}

查看效果(一条慢日志查询会显示一条,如果不进行正则匹配,那么一行就会显示一条)

ELK LOGSTASH MySQL慢日志的展示_elasticsearch




举报

相关推荐

0 条评论