In addition to sending system logs to logstash, it is possible to add a prospector section to the filebeat.yml for jboss server logs. Sometimes jboss server.log has single events made up from several lines of messages. In such cases Filebeat should be configured for a multiline prospector.
Filebeat takes lines do not start with a date pattern (look at pattern in the multiline section "^[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2}" and negate section is set to true) and combines them with the previous line that starts with a date pattern.
server.log file excerpt where DatePattern: yyyy-MM-dd-HH and ConversionPattern: %d %-5p [%c] %m%n
server.log file excerpt where DatePattern: yyyy-MM-dd-HH and ConversionPattern: %d %-5p [%c] %m%n
Logstash filter:
Hello,
ReplyDeleteI use your tutorial, i need to use some index pattern differente from filebeat-* ?
Thanks
Hi, what do you mean by index pattern? is it elasticsearch index? If so, you can configure logstash's elasticsearch output section to change index pattern.
ReplyDeletenow with filebeats modules, is there a module for jboss server.log?
ReplyDeleteI know there are some modules for nginx, apache etc. but not sure if there is one for jboss.
Delete