ELK logstash processing MySQL slow query log (Preliminary)

Write in front: In doing Elk logstash processing MySQL slow query log when the problem: 1, the test database does not have slow log, so there is no log information, resulting in ip:9200/_plugin/head/interface anomalies (suddenly appear log data, deleted the index disappeared) 2, Processing log script Problem 3, the current single-node configuration script file/usr/local/logstash-2.3.0/config/slowlog.conf "Verbose script file see last" output {elasticsearch {hosts = "1    15.28.3.150:9200 "index =" mysql-slowlog "workers = 1 Flush_size = 20000 Idle_flush_time = 10 Template_overwrite = True}} defines the IP and port of the Elasticsearch in Outpout and the index name [[email protected] config]#. /bin/logstash agent-f Slowlog.confSettings:Default Pipeline workers:1pipeline main started in http://115.28.3.150:9200/ Refresh on _plugin/head/page:

--------------------------------------------------------------------------------------------------------------- ----------------

Cat/usr/local/logstash-2.3.0/config/slowlog.conf

Input {

File {
Type = "Mysql-slow"
Path = "/mnt/data/mysql/mysql-slow.log"
Start_position = "Beginning"
Codec = Multiline {
Pattern = "^# time:"
Negate = True
what = "Previous"
}
}
}
Filter {
Grok {
Match + = {"Message" = "Select SLEEP"}
Add_tag = ["Sleep_drop"]
Tag_on_failure = []
}
If "Sleep_drop" in [tags] {
Drop {}
}
Grok {
Match + = ["Message", "(? m) ^# time:.*\s+# [email protected]:%{user:user}\[[^\]]+\] @ (?:(?) <clienthost>\s*)? \[(?:%{ip:clientip})? \]\s*id:%{number:id:int}\s+# query_time:%{number:query_time:float} \s+lock_time:%{number:lock_time:float}\s+rows_sent:%{number:rows_sent:int}\s+rows_examined:%{NUMBER:rows_ examined:int}\s* (?: Use%{data:database};\s*)? SET timestamp=%{number:timestamp};\s* (?<query> (? <action>\w+) \s+.*) $ "]
}
Date {
Match = ["timestamp", "UNIX"]
Remove_field = ["Timestamp"]
}
}
Output {
Elasticsearch {
hosts = "192.168.98.163:9200"
index = "Mysql-slowlog"
Workers = 1
Flush_size = 20000
Idle_flush_time = 10
Template_overwrite = True
}
}

ELK logstash processing MySQL slow query log (Preliminary)