Filebeat.yml

Filebeat.yml

# Tomcat Log Pattern (Log4j2)
# [%equals{%X{works_rid}}{}{startup}] %d{yyyy-MM-dd HH:mm:ss} [%-5p](%-35c{1}:%-3L) %m%n

# Tomcat Log Example 
#[42744e73aebe5366cf627e8cf71c3da6] 2022-12-29 17:31:43 [DEBUG](GetProductService :118) 존재하지 않는 Product 입니다.


# Nginx Log Pattern
#        log_format  main  '$request_id $remote_addr - $remote_user [$time_local] "$request" '
#                   '$status $body_bytes_sent "$http_referer" "$request_time" '
#                   '"$http_user_agent" "$http_x_forwarded_for" '
#                   '"$ssl_protocol/$ssl_cipher" "$content_length" '
#                   '"$request_length" ' ;

# Nginx Log Example 
# 13ceadb76500f7c1cca856bb1022bcf4 127.0.0.1 - - [27/Dec/2022:15:53:42 +0900] "GET /kr/favicon.ico?20221226 HTTP/2.0" 200 5430 "http://localhost:8080/test" "0.008" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36" "-" "TLSv1.2/ECDHE-RSA-AES128-GCM-SHA256" "-" "148"


filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /home/mangkyu/logs/tomcat/mangkyu*.log
    fields:
      topic: works_mangkyu
      region: "kr1"
      project: "mangkyu"
      log_type: "tomcat"

    multiline.pattern: ^\[[0-9a-fA-F]{32}\][[:space:]][0-9]{4}-[0-9]{2}-[0-9]{2}[[:space:]][0-9]{2}:[0-9]{2}:[0-9]{2}[[:space:]]\[
    multiline.negate: true
    multiline.match: after

  - type: log
    enabled: true
    paths:
      - /home/mangkyu/logs/nginx/access_ssl_*.log
    fields:
      topic: works_mangkyu
      region: "kr1"
      project: "mangkyu"
      log_type: "nginx"

    multiline.pattern: ^[0-9a-fA-F]{32}[[:space:]]
    multiline.negate: true
    multiline.match: after

output.kafka:
  enabled: true
  hosts: ["kafka-mangkyu.mangkyu.com:9092"]
  topic: '%{[fields.topic]}'