Logstash cheat sheet: Difference between revisions

'''filebeat.yml 例 (1.x -> 5.0 仮)'''

############################# Filebeat ######################################

        - /var/log/apache2/other_vhosts_access.log

      fields_under_root: true

    -

      paths:

        - /var/log/apache2/error.log

      input_type: log

      document_type: apache-error

      fields_under_root: true

    -

      paths:

        - /var/log/dpkg.log

      input_type: log

      document_type: dpkg

      fields_under_root: true

   # General filebeat configuration options

   #

  # Event count spool threshold - forces network flush if exceeded

   #spool_size: 2048

   # Defines how often the spooler is flushed. After idle_timeout the spooler is

   # Flush even though spool_size is not reached.

   #idle_timeout: 5s

   # Name of the registry file. Per default it is put in the current working

   # directory. In case the working directory is changed after when running

   registry_file: /var/lib/filebeat/registry

   # These config files must have the full filebeat config part inside, but only

  # the prospector part is processed. All global options like spool_size are ignored.

   # The config_dir MUST point to a different directory then where the main filebeat config file is in.

   #config_dir:

###############################################################################

# Configure what outputs to use when sending the data collected by the beat.

    # Number of workers per Logstash host.

    #worker: 1

    # Set gzip compression level.

    #compression_level: 3

    # Optional load balance the events between the Logstash hosts

    #loadbalance: true

    # Optional index name. The default index name depends on the each beat.

    # top topbeat and for Filebeat to filebeat.

    #index: filebeat

    # Optional TLS. By default is off.

      # List of root certificates for HTTPS server verifications

      certificate_authorities: ["/etc/logstash/logstash-forwarder.crt"]

      # Certificate for TLS client authentication

      #certificate: "/etc/logstash/logstash-forwarder.crt"

      # Client Certificate Key

      #key: "/etc/logstash/logstash-forwarder.key"

      #verification_mode: none

      verification_mode: none

      # Configure cipher suites to be used for TLS connections

 

 

 

# There are three options for the log ouput: syslog, file, stderr.

# Under Windos systems, the log files are per default sent to the file output,

# under all other system per default to syslog.

logging:

  # Send all logging output to syslog. On Windows default is false, otherwise

  # default is true.

  #to_syslog: true

  # Write all logging output to files. Beats automatically rotate files if rotateeverybytes

  # limit is reached.

  #to_files: false

  to_files: true

  # To enable logging to files, to_files option has to be set to true

  files:

    # The directory where the log files will written to.

    #path: /var/log/mybeat

    path: /var/log/filebeat

    # The name of the files where the logs are written to.

    #name: mybeat

    name: filebeat.log

    # Configure log file size limit. If limit is reached, log file will be

    # automatically rotated

    rotateeverybytes: 10485760 # = 10MB

    # Number of rotated log files to keep. Oldest files will be deleted first.

    #keepfiles: 7

    keepfiles: 7

   # Enable debug output for selected components. To enable all selectors use ["*"]

   # Multiple selectors can be chained.

   #selectors: [ ]

  # Sets log level. The default log level is error.

  # Available log levels are: critical, error, warning, info, debug

  level: info