filebeat.inputs:
- type: log
  tail_files: true
  backoff: "1s"
  paths:
      - /var/log/nginx/*.log
# 输出到文件,一般用于调试日志输出格式
output.file:
  path: "/tmp/filebeat"
  filename: filebeat
  
# 输出到logstash
output:
  logstash:
    hosts: ["192.168.238.90:5044"]
    
# 输出到ES
output:
  elasticsearch:
    hosts: ["192.168.238.90:9200", "192.168.238.92:9200"]
    username: elastic
    password: sjgpwd
    index: "sjgfb-secure-%{+YYYY.MM.dd}"

日志模板
cat <<EOF >>/var/log/tomcat
07-Aug-2020 20:15:41.950 INFO [localhost-startStop-1] org.apache.catalina.core.ApplicationContext.log SessionListener: contextInitialized()
07-Aug-2020 20:15:45.954 INFO [localhost-startStop-1] org.apache.catalina.core.ApplicationContext.log ContextListener: attributeAdded('StockTicker', 'async.Stockticker@5b24dcf6')
07-Aug-2020 20:15:47.959 SEVERE [http-nio-8080-exec-1] org.apache.catalina.core.StandardWrapperValve.invoke Servlet.service() for servlet [jsp] in context with path [/sjg] threw exception [java.lang.ArithmeticException: / by zero] with root cause
at org.apache.jsp.sjg_jsp._jspService(sjg_jsp.java:110)
at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:71)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:476)
at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:386)
EOF

Filebeat提取多行日志看是否正常
filebeat.inputs:
- type: log
  tail_files: true
  backoff: "1s"
  paths:
      - /var/log/tomcat
  multiline:
    pattern: '^\d+-[a-zA-Z]+-\d+ \d+:\d+:\d+.\d+'
    negate: true
    match: after

processors:
# 去除多余日志
- drop_fields:
    fields: ["agent","ecs","log","input"]

output.file:
  path: "/tmp/filebeat"
  filename: filebeat

filter {
# grok正则提取日志
  grok {
  # 指定对哪个字段进行正则提取
    match => {
      "message" => '(?<timestamp>\d+-\d+-\d+ \d+:\d+:\d+) %{WORD:host} sshd\[%{NUMBER}\]: %{WORD:loginstatus} password for %{USER:user} from %{IP:remote_ip}'
    }
    # 删除原始字段
    remove_field => ["message"]
}

filter {
  mutate {
  # 字段特殊处理 去除双引号
    gsub => [ "http_user_agent",'"',"" ]
    gsub => [ "url",'"',"" ]
    # 字符串转整型
    convert => { "status" => "integer" }
    convert => { "body_bytes_sent" => "integer" }
    # 删除字段
    remove_field => ["time_local"]
  }
  }