如何rasie存储在elk堆栈中的日志的日志级别

Question

是否可以提高存储在ELK堆栈上的日志的日志级别？现在我发现所有日志级别都存储在我的elk堆栈中，我只希望那些警告和错误日志存储在堆栈中，怎么做？

Answer 1

我认为你正在寻找logstash drop过滤器，它允许你根据一些标准过滤出日志，在你的情况下调试，信息等。从文档，一个过滤器可能看起来像：

filter { 
    if [loglevel] == "debug" { 
    drop { } 
    } 
} 

https://www.elastic.co/guide/en/logstash/current/plugins-filters-drop.html

而且，你的问题看起来与此类似：

Logstash drop filter for event

Answer 2

如果你有一个日志文件test.log中如下所示：

DEBUG | 2008-09-06 10:51:44,817 | DefaultBeanDefinitionDocumentReader.java | 86 | Loading bean definitions 
WARN | 2008-09-06 10:51:44,848 | AbstractBeanDefinitionReader.java | 185 | Loaded 5 bean definitions from location pattern [samContext.xml] 
INFO | 2008-09-06 10:51:44,848 | XmlBeanDefinitionReader.java | 323 | Loading XML bean definitions from class path resource [tmfContext.xml] 
DEBUG | 2008-09-06 10:51:44,848 | DefaultDocumentLoader.java | 72 | Using JAXP provider [com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderFactoryImpl] 
ERROR | 2008-09-06 10:51:44,848 | BeansDtdResolver.java | 72 | Found beans DTD [http://www.springframework.org/dtd/spring-beans.dtd] in classpath: spring-beans.dtd 
ERROR | 2008-09-06 10:51:44,864 | DefaultBeanDefinitionDocumentReader.java | 86 | Loading bean definitions 
DEBUG | 2008-09-06 10:51:45,458 | AbstractAutowireCapableBeanFactory.java | 411 | Finished creating instance of bean 'MS-SQL' 

您可以定义ñ如果有条件的消息，你想保留和删除其他：

input { 
    file { 
     path => "/your/path/test.log" 
     sincedb_path => "/your/path/test.idx" 
     start_position => "beginning" 
    } 
} 

filter { 
    if [message] =~ "WARN" or [message] =~ "ERROR" { 

    } else { 
     drop {} 
    } 
} 

output { 
    stdout { 
     codec => rubydebug  
    } 
} 

然后，你会看到如下页面：

{ 
     "message" => "WARN | 2008-09-06 10:51:44,848 | AbstractBeanDefinitionReader.java | 185 | Loaded 5 bean definitions from location pattern [samContext.xml]", 
     "@version" => "1", 
    "@timestamp" => "2015-09-17T18:30:24.897Z", 
      "host" => "MacBook-Pro-de-Alain.local", 
      "path" => "/Users/Alain/Workspace/elk/logstash-1.5.4/config/filter/test.log" 
} 
{ 
     "message" => "ERROR | 2008-09-06 10:51:44,848 | BeansDtdResolver.java | 72 | Found beans DTD [http://www.springframework.org/dtd/spring-beans.dtd] in classpath: spring-beans.dtd", 
     "@version" => "1", 
    "@timestamp" => "2015-09-17T18:30:24.898Z", 
      "host" => "MacBook-Pro-de-Alain.local", 
      "path" => "/Users/Alain/Workspace/elk/logstash-1.5.4/config/filter/test.log" 
} 
{ 
     "message" => "ERROR | 2008-09-06 10:51:44,864 | DefaultBeanDefinitionDocumentReader.java | 86 | Loading bean definitions", 
     "@version" => "1", 
    "@timestamp" => "2015-09-17T18:30:24.899Z", 
      "host" => "MacBook-Pro-de-Alain.local", 
      "path" => "/Users/Alain/Workspace/elk/logstash-1.5.4/config/filter/test.log" 
} 

问候， 阿兰