<extension json> module xm_json</extension><extension charconv> module Xm_charconv Autodete Ctcharsets GBK #自动检测GBK字符集 and define </extension><extension multiline> Module xm_multiline in input Multiline match headerline/^\d+-\w+-\d+/#行首匹配 </extension><input access> Module im_file file "/home/tomcat/access.log" #定义了采集的日志路径, wildcard characters savepos true readfromlast true Recursive true Renamecheck TRUE pollinterval 1 Exec convert_fields ("AUTO", "utf-8"); #表示识别GBK中的字符编码 and converted to UTF8 code Exec $source = Host_ip (); Exec $sourcetype = "tomcat-access"; Exec $app = "WEB"; Exec $filename = file_name (); </input><input catalina> Module im_file file "/home/tomcat/c Atalina.out "Savepos true readfromlasttrue Recursive true Renamecheck true Pollinterv Al 1 InputType mUltiline #Exec convert_fields ("AUTO", "utf-8"); Exec $source = Host_ip (); Exec $sourcetype = "Tomcat-catalina"; Exec $app = "WEB"; Exec $filename = file_name (); </input><output loginsight_access> Module om_tcp Host 192.16 8.11.196 Port 1516 Exec sleep (1000); Exec $message = $raw _event;to_json (); </output><output loginsight_catalina> Module om_tcp Hos T 192.168.11.196 Port 1517 Exec Sleep (1000); Exec $message = $raw _event;to_json (); </output><route 1> Path access + = LOGINSIGHT_ACCESS</R Oute><route 2> Path catalina = loginsight_catalina</route>
Configuration interpretation of the Log collector Windows client