Skip to content

Instantly share code, notes, and snippets.

@chanjarster
Created September 22, 2015 07:41
Show Gist options
  • Save chanjarster/f97a19bc0579514c3237 to your computer and use it in GitHub Desktop.
Save chanjarster/f97a19bc0579514c3237 to your computer and use it in GitHub Desktop.
Tomcat Access Log Logstash configration
input {
file {
path => "/path/to/tomcat/logs/localhost_access_log*.txt"
}
}
filter {
grok {
match => {
"message" => "%{COMBINEDAPACHELOG} %{IPORHOST:serverip} %{NUMBER:serverport} %{NUMBER:elapsed_millis} %{NOTSPACE:sessionid} %{QS:proxiedip} %{QS:loginame}"
}
overwrite => [ "message" ]
remove_field => [ "ident", "auth" ]
}
useragent {
source => "agent"
target => "ua"
remove_field => [ "agent" ]
}
mutate {
gsub => [
"request", "\?.+", "",
"proxiedip", "(^\"|\"$)", "",
"loginame", "(^\"|\"$)" , "",
"referrer", "(^\"|\"$)" , ""
]
}
if [proxiedip] != "-" {
mutate {
replace => {
"clientip" => "%{proxiedip}"
}
}
}
if ![bytes] {
mutate {
add_field => {
"bytes" => "0"
}
}
}
mutate {
remove_field => ["proxiedip"]
}
mutate {
convert => {
"bytes" => "integer"
"elapsed_millis" => "integer"
"serverport" => "integer"
}
}
date {
match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
}
}
output {
if "_grokparsefailure" not in [tags] {
stdout {
codec => rubydebug
}
elasticsearch {
protocol => "http"
host => "localhost"
}
}
}
<!-- Access log processes all example.
Documentation at: /docs/config/valve.html
Note: The pattern used is equivalent to using pattern="common"
combined + %A + %p + %D + %S + 真实IP + 用户名
%h - Remote host name (or IP address if enableLookups for the connector is false)
%l - Remote logical username from identd (always returns '-')
%u - Remote user that was authenticated (if any), else '-'
%t - Date and time, in Common Log Format
%r - First line of the request (method and request URI)
%s - HTTP status code of the response
%b - Bytes sent, excluding HTTP headers, or '-' if zero
Referer
User-Agent
%A - Local IP address
%p - Local port on which this request was received. See also %{xxx}p below.
%D - Time taken to process the request, in millis
%S - User session ID
X-Forwarded-For
SECURITY_LOGIN_NAME
-->
<Valve className="org.apache.catalina.valves.AccessLogValve"
directory="logs"
prefix="localhost_access_log"
suffix=".txt"
encoding="utf8"
pattern="%h %l %u %t &quot;%r&quot; %s %b &quot;%{Referer}i&quot; &quot;%{User-Agent}i&quot; %A %p %D %S &quot;%{X-Forwarded-For}i&quot; &quot;%{SECURITY_LOGIN_NAME}s&quot;" />
@aszhou
Copy link

aszhou commented May 30, 2016

能给出注释就更好了。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment