合并多行以[为头
multiline:
pattern: '^\['
negate: true
match: after
------------------------------------------------
过滤掉某行
exclude_lines: ['^#']----------------------------
# cat filebeat.yml
filebeat.prospectors:
- type: log
paths:
- /data/log/tomcat/localhost_access_log.*.txt
exclude_lines: ['^#']
fields:
tag: accesslog-121
- type: log
paths:
- /data/log/tomcat/catalina.out
exclude_lines: ['^#']
fields:
tag: catalina-121
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: true
output.redis:
hosts: ["127.0.0.1"]
port: 6380
key: "tomcat121-autoschedulecore-access-list"--------------------------------包含某行
filebeat.prospectors: - input_type: log paths: - /tmp/test.log include_lines: [‘error‘]
---------------------------------------------------------------------------------------------------
filebeat.prospectors:
- type: log
paths:
- /ali/logs/*.out
multiline:
pattern: '^\['
negate: true
match: after
fields:
tag: log1
- type: log
paths:
- /ali/logs/*.conf
fields:
tag: log2
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
output.redis:
hosts: ["127.0.0.1"]
port: 6380
key: "test-list"
来源：http://www.cnblogs.com/liqing1009/p/8409756.html