aqueducts_logstash_example.conf

gistfile1.txt

input {
  file { 
    # 详细配置项请参考http://logstash.net/docs/1.3.3/inputs/file
    path => "/home/work/local/imas.log"
    
    # 附加自定义字段
    # add_field => { "input_a" => "input_a"
    #                "input_b" => "input_b"
    #              } 
  }
}

filter {
  
  # 通过正则提取需要计算的字段
  grok {
    # 详细配置项请参考http://logstash.net/docs/1.3.3/filters/grok
    match => [ "message", "^(?<page_view>NOTICE):.*tt=(?<response_time>[0-9]*)" ]
  }
      
  # 统计发送分钟级别的发送量
  metrics {
    meter => "events"
    clear_interval => 60
    flush_interval => 60
    rates => [1]
    add_tag => "metric"
  }
}

output {
#  stdout { debug => true }
  if "metric" in [tags] {
    # 统计数据发送通道
    kafka {
      product => "aqueducts"
      service => "logstash"
    }
  } else {
    # 日志数据发送通道
    kafka {
      product => "astream" # 产品线，需修改
      service => "test" # 服务，需修改
    }
  }
}