I am new to Logstash and ELK as a whole. I am trying to send my airflow logs to Logstash. I am confused on how to configure my configuration file, especially because I have several (nested) log files.
My airflow is deployed on an AWS EC2 instance and my logs directory is something like this: /home/ubuntu/run/logs/scheduler/
The scheduler directory has a couple of dated folders. Using one of the folders as an example: /home/ubuntu/run/logs/scheduler/2022-08-31.
The dated folder has files such as
testing.py.log hello_world.py.log dag_file.py.log
Now, while configuring my /etc/logstash/conf.d/
(based on the log path I shared above), how can I define my path to pick all the logs?
This is what my /etc/logstash/conf.d/apache-01.conf
currently looks like, but I know the path isn't accurate:
input {
file {
path => "~/home/ubuntu/run/log/scheduler/"
start_position => "beginning"
codec -> "line"
}
}
filter {
grok {
match => { "path" => "" }
}
mutate {
add_field => {
"log_id" => "%{[dag_id]}-%{[task_id]}-%{[execution_date]}-%{[try_number]}"
}
}
}
output{
elasticsearch {
hosts => ["localhost:9200"]
}
}
The path parameter needs a absolute path. To process all py.log files you can use this input
input {
file {
path => "/home/ubuntu/run/logs/scheduler/*/*py.log"
start_position => "beginning"
codec -> "line"
}
}
To process only the files hello_world.py.log and dag_file.py.log you can use an array for your path
input {
file {
path => ["/home/ubuntu/run/logs/scheduler/*/hello_world.py.log", "/home/ubuntu/run/logs/scheduler/*/dag_file.py.log"]
start_position => "beginning"
codec -> "line"
}
}
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.