Filebeat + Logstash Surveillance des clous Alarme du journal des erreurs PHP

Style de journal des erreurs PHP

[2021-03-05T00: 04: 12 + 08: 00] 175.167.136.244 POST api.51cto.cn/User/getUserInfo 
[erreur] [10] nologin [/var/www/html/api.51cto.cn/application /common/controllers/BaseController.php:239]

Télécharger filebeat-7.10.2

filebeat.inputs: 
- type: journal 
  activé: 
  chemins vrais : 
    - /data/error/*.log 
  multiline.pattern: '^ \ [\ d {4} \ - \ d {2} \ - \ d {2}' 
  multiline.negate: true 
  multiline.match: après 
- type: filestream 
  activé: faux 
  chemins: 
    - /var/log/*.log 
filebeat.config.modules: 
  chemin: $ {path.config} /modules.d / *. yml 
  reload.enabled: false 
setup.template.settings: 
  index.number_of_shards: 1 
setup.kibana: 
output.logstash: 
  hosts: ["192.168.0.1:5044"] 
processeurs: 
  - add_host_metadata: 
      when.not.contains.tags: forwarded 
  - add_cloud_metadata: ~
  - add_docker_metadata: ~ 
  - add_kubernetes_metadata: ~

logstash j'utilise docker

Créer un fichier

/data/logstash/conf/logstash.yml

http.host: "0.0.0.0"

/data/logstash/pipeline/logstash.conf

input { 
  beats { 
    port => 5044 
  } 
} 
filter { 
    if "Allowed memory size" in [message] { 
        drop {} 
     } 
    if "Maximum execution time" in [message] { 
        drop {} 
     } 
} 
output { 

  http { 
    http_method => "post" 
    url => "http://api.xxx.cn/api/dingtalk/send" 
    format => "json" # 如果 是 表单 就是 form 
    mapping => { 
      "access_token" => "297873a03c25bc202bf1264ca0e101847aed21321313213131321" 
      " => "text" 
      "content" => "报警:% {message}"
    } 
    } 
}

Démarrer le docker

docker run -d -p 5044: 5044 -p 9600: 9600 -v /data/logstash/conf/logstash.yml:/usr/share/logstash/config/logstash.yml -v / data / logstash / pipeline: / usr / share / logstash / pipeline --restart = toujours logstash: 7.10.1