がとらぼ

INTAA.NET

#!/bin/sh
ncpu=$( sysctl hw.ncpu | awk '{ print $2 }' )
out=$( /bin/date '+%Y-%m-%d %H:%M:%S' )
i=0

while [ ${i} -lt ${ncpu} ]
do
 out="${out} `sysctl dev.cpu.${i}.temperature | sed -e 's|.*: \([0-9.]*\)C|\1|'`"
 i=`expr ${i} + 1`
done

echo ${out} > /tmp/temperature.tmp
sleep 15
rm /tmp/temperature.tmp

filebeat.prospectors:
#前回の記事のFail2ban用の設定ここから
- type: log
  enabled: true
  paths:
    - /var/log/fail2ban.log
  fields:
    type: fail2ban
  include_lines: [' Ban ']
  exclude_lines: ['Restore']
  processors:
    - drop_fields:
         fields: ['offset', 'source']
#前回の記事のFail2ban用の設定ここまで
#今回の記事用の設定はここから
- type: log
  enabled: true
  paths:
    - /tmp/temperature.tmp              #←ログファイル
  fields:
    type: temperature                   #fields.typeを temperature とした
  processors:
    - drop_fields:                      #出力したくないフィールドの指定
         fields: ['offset', 'source']   #今回はoffsetとsourceを出力しない
#←今回の記事用の設定はここまで

filebeat.config.modules:
  path: ${path.config}/beats/file_*.yml #今回も使わない
  reload.enabled: false

output.logstash:
  hosts: ["192.168.2.24:5043"]          #Logstash稼働ホストのテスト用ポートに出力
#  hosts: ["192.168.2.24:5044"]         #Logstash稼働ホストの本番用ポート

#logging.level: debug
logging.selectors: ["*"]
logging.to_syslog: false                #Filebeatのログをsyslogに出力しない
logging.to_files: false                 #Filebeatのログファイルは出力しない
logging.files:
  path: /var/log
  name: filebeat.log

input {
    beats {
        port => 5043    #テスト用ポート
    }
}

filter {
  #前回の記事のFail2ban用ここから
  if [fields][type] == "fail2ban" {
    grok {
      patterns_dir => ["/usr/local/etc/logstash/patterns"]
      match => {"message" => "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME},%{NUMBER} fail2ban\.actions%{SPACE}\[%{NUMBER}\]\: NOTICE  \[%{USERNAME:jail}\] Ban %{IP:ip}"}
      remove_field => ["message", "beat", "tags"]
    }
    geoip {
      source => "ip"
    }
  }
  #前回の記事のFail2ban用ここまで

  #今回の記事用の追加設定ここから
  if [fields][type] == "temperature" {
    grok {
      patterns_dir => ["/usr/local/etc/logstash/patterns"]
      match => { "message" => "%{YEAR}-%{MONTHNUM}-%{MONTHDAY} %{TIME} %{GREEDYDATA:message}" }
      "overwrite" => "message"
    }
    grok {
      "match" => { "message" => [
        "%{NUMBER:[temperature]core0} %{NUMBER:[temperature]core1} %{NUMBER:[temperature]core2} %{NUMBER:[temperature]core3} %{NUMBER:[temperature]core4} %{NUMBER:[temperature]core5} %{NUMBER:[temperature]core6} %{NUMBER:[temperature]core7}",
        "%{NUMBER:[temperature]core0} %{NUMBER:[temperature]core1} %{NUMBER:[temperature]core2} %{NUMBER:[temperature]core3}",
        "%{NUMBER:[temperature]core0} %{NUMBER:[temperature]core1}",
        "%{NUMBER:[temperature]core0}"
        ]
      }
      remove_field => ["message", "beat", "tags"]
    }
    mutate {
      convert => {
        "[temperature]core0" => "float"
        "[temperature]core1" => "float"
        "[temperature]core2" => "float"
        "[temperature]core3" => "float"
        "[temperature]core4" => "float"
        "[temperature]core5" => "float"
        "[temperature]core6" => "float"
        "[temperature]core7" => "float"
      }
    }
  }
  #今回の記事用の追加設定ここまで
}

output {
    stdout { codec => rubydebug }           #テスト用  コンソールに出力
    #elasticsearch { hosts => [ "localhost:9200" ] }
}

{
         "fields" => {
        "type" => "temperature"
    },
       "@version" => "1",
     "@timestamp" => 2018-03-14T07:34:00.963Z,
           "host" => "hoge.localnet",
     "prospector" => {
        "type" => "log"
    },
    "temperature" => {
        "core2" => "32.0",
        "core0" => "32.0",
        "core3" => "32.0",
        "core1" => "32.0"
    }
}

.es(interval='1m', q='host:hoge.localnet', metric='max:temperature.core0').lines(width=1, fill=1).label('core0'), 
.es(interval='1m', q='host:hoge.localnet', metric='max:temperature.core1').lines(width=1).label('core1'), 
.es(interval='1m', q='host:hoge.localnet', metric='max:temperature.core2').lines(width=1).label('core2'), 
.es(interval='1m', q='host:hoge.localnet', metric='max:temperature.core3').lines(width=1).label('core3').yaxis(min=0, max=60)