filebeat+logstash钉钉监控PHP错误日志报警

PHP的错误日志样式

[2021-03-05T00:04:12+08:00] 175.167.136.244 POST api.51cto.cn/User/getUserInfo
[ error ] [10]nologin[/var/www/html/api/application/common/controllers/BaseController.php:239]

下载filebeat-7.10.2

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /data/error/*.log
  multiline.pattern: '^\[\d{4}\-\d{2}\-\d{2}'
  multiline.negate: true
  multiline.match: after
- type: filestream
  enabled: false
  paths:
    - /var/log/*.log
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
setup.kibana:
output.logstash:
  hosts: ["192.168.0.1:5044"]
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

logstash我用的docker

创建文件

/data/logstash/conf/logstash.yml

http.host: "0.0.0.0"

/data/logstash/pipeline/logstash.conf

input {
  beats {
    port => 5044
  }
}
filter {
    if "Allowed memory size" in [message]{
        drop{}
     }
    if "Maximum execution time" in [message] {
        drop{}
     }
}
output {

  http {
    http_method => "post"
    url => "http://api.xxx.cn/api/dingtalk/send"
    format => "json"   #如果是表单就是form
    mapping => {
      "access_token" => "297873a03c25bc202bf1264ca0e101847aed213213132131321"
      "msg_type" => "text"
      "content" => "报警: %{message}"
    }
    }
}

启动docker

docker run -d -p 5044:5044 -p 9600:9600 -v /data/logstash/conf/logstash.yml:/usr/share/logstash/config/logstash.yml -v /data/logstash/pipeline:/usr/share/logstash/pipeline --restart=always logstash:7.10.1

来源：https://blog.51cto.com/fengwan/2678093