Filebeat收集tomcat的json格式日志

1.安装tomcat

yum安装tomcat9.0服务

2.配置tomcat日志格式为json

找到tomcat安装路径里的server.xml配置文件修改如下内容

vim /opt/tomcat/conf/server.xml

pattern="{"clientip":"%h","ClientUser":"%l","authenticated":"%u","AccessTime":"%t","method":"%r","status":"%s","SendBytes":"%b","Query?string":"%q","partner":"%{Referer}i","AgentVersion":"%{User-Agent}i"}"/>

3.启动tomcat

/opt/tomcat/bin/startup.sh

4.配置Filebeat

cat >/etc/filebeat/filebeat.yml <<EOF
filebeat.inputs:

- type: log
enabled: true
paths:
- /opt/tomcat/logs/localhost_access_log.*.txt
json.keys_under_root: true
json.overwrite_keys: true
tags: ["tomcat"]

output.Elasticsearch:
hosts: ["10.0.0.51:9200"]
index: "tomcat_access-%{[beat.version]}-%{+yyyy.MM}"

setup.template.name: "tomcat"
setup.template.pattern: "tomcat_*"
setup.template.enabled: false
setup.template.overwrite: true
EOF

5.重启filebeat

systemctl restart filebeat

6.访问tomcat查看是否有数据生成