nxlog推送数据到elasticsearch

其实rsyslog、syslog-ng、nxlog这三种东西真的是都差不多。随便选一个用都没问题。

比较喜欢nxlog的route和json功能，所以用它来推数据到elasticsearch

用om_elasticsearch推：

...
<Input in>  
        Module im_tcp
        Host 0.0.0.0
        Port 1514
    InputType Binary
</Input>

<Output es>  
        Module om_elasticsearch
        URL http://localhost:9200/_bulk
        FlushInterval 2
        FlushLimit 100
        # Create an index daily
        Index strftime($EventTime, "nxlog-%Y%m%d")
        IndexType "My logs"

        # Use the following if you don't have $EventTime set
        #Index strftime(now(),"nxlog-%Y%m%d")
</Output>

<Route r>  
        Path in => es
</Route>  
...

用om_http推：

...
<Output elasticsearch>  
    Module      om_http
    URL         http://elasticsearch:9200
    ContentType application/json
    Exec        set_http_request_path(strftime($EventTime, "/nxlog-%Y%m%d/" + $SourceModuleName)); rename_field("timestamp","@timestamp"); to_json();
</Output>  
...

我们生产上是将各个机器上的日志通过rsyslog发到nxlog，再由nxlog导入elasticsearch，然后用kinaba看：