ycz
/
OKR
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

add logstash-alert filter and add field stack_trace

main
ycz008 2024-02-28 14:38:34 +08:00
parent a441a1f74c
commit 0fffd68c39
2 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
build-image/logstash/log-alert.sh
View File

@ -1,17 +1,17 @@
#!/bin/bash #!/bin/bash
# @timestamp serviceName env level message # @timestamp serviceName env level message
if (($#!=5));then if (($#!=6));then
echo "./log-alert.sh %{@timestamp} %{serviceName} %{env} %{level} %{message}" echo "./log-alert.sh %{@timestamp} %{serviceName} %{env} %{level} %{message} %{stack_trace}"
exit 1 exit 1
fi fi
if [[ -z $1 || -z $2 || -z $3 || -z $4 || -z $5 ]];then if [[ -z $1 || -z $2 || -z $3 || -z $4 || -z $5 || -z $6 ]];then
echo "one of '%{@timestamp} %{serviceName} %{env} %{level} %{message}' is empty" echo "one of '%{@timestamp} %{serviceName} %{env} %{level} %{message}' is empty"
exit 1 exit 1
fi fi
msg="timestamp: $1\nserviceName: $2\nenv: $3\nlevel: $4\nmessage: $5\n" msg="timestamp: $1\nserviceName: $2\nenv: $3\nlevel: $4\nmessage: $5\nstack_trace: $6\n"
#echo -ne $msg #echo -ne $msg
curl -X POST -H "Content-Type: application/json" -d "{\"msg_type\":\"text\",\"content\":{\"text\":\"$msg\"}}" https://open.feishu.cn/open-apis/bot/v2/hook/29dd52e5-70d5-44b0-a443-22ea85382646 curl -X POST -H "Content-Type: application/json" -d "{\"msg_type\":\"text\",\"content\":{\"text\":\"$msg\"}}" https://open.feishu.cn/open-apis/bot/v2/hook/29dd52e5-70d5-44b0-a443-22ea85382646

9
dev-upgrade/elastic/logstash-alert.yaml
View File

@ -35,6 +35,13 @@ data:
if [message] =~ "Fail to parse JWT due to: Jwt expired at" { if [message] =~ "Fail to parse JWT due to: Jwt expired at" {
drop {} drop {}
} }
if [message] =~ "Unauthorized access" {
drop {}
}
if [message] =~ "exchange refresh token" {
drop {}
}
mutate { mutate {
split => { "[log][file][path]" => "/" } split => { "[log][file][path]" => "/" }
add_field => { "env" => "%{[log][file][path][3]}" } add_field => { "env" => "%{[log][file][path][3]}" }
@ -51,7 +58,7 @@ data:
# codec => "json_lines" # codec => "json_lines"
# } # }
exec { exec {
command => "/usr/local/bin/log-alert.sh '%{@timestamp}' '%{serviceName}' '%{env}' '%{level}' '%{message}'" command => "/usr/local/bin/log-alert.sh '%{@timestamp}' '%{serviceName}' '%{env}' '%{level}' '%{message}' '%{stack_trace}'"
} }
} }
logstash.yml: |- logstash.yml: |-