41 lines
2.3 KiB
Properties
41 lines
2.3 KiB
Properties
security.sources = s2
|
||
security.channels = c2
|
||
#指定source收集到的数据发送到哪个管道
|
||
security.sources.s2.channels = c2
|
||
#taildir source
|
||
security.sources.s2.type = TAILDIR
|
||
security.sources.s2.channels = c2
|
||
#需要映射到宿主机做持久化
|
||
security.sources.s2.positionFile = /home/test/3security_position.json
|
||
#需要分组13台主机的数据
|
||
security.sources.s2.filegroups = f1 f2 f3 f4 f5 f6 f7 f8 f9 f10 f11 f12 f13
|
||
#需要分组按照序号 [0-9] 目前最多支持10个进程，可以增加
|
||
security.sources.s2.filegroups.f1 = /home/data/192.168.60.101/SECURITY-EVENT-LOG/.*[4-5].dat
|
||
security.sources.s2.filegroups.f2 = /home/data/192.168.60.102/SECURITY-EVENT-LOG/.*[4-5].dat
|
||
security.sources.s2.filegroups.f3 = /home/data/192.168.60.103/SECURITY-EVENT-LOG/.*[4-5].dat
|
||
security.sources.s2.filegroups.f4 = /home/data/192.168.60.104/SECURITY-EVENT-LOG/.*[4-5].dat
|
||
security.sources.s2.filegroups.f5 = /home/data/192.168.60.105/SECURITY-EVENT-LOG/.*[4-5].dat
|
||
security.sources.s2.filegroups.f6 = /home/data/192.168.60.106/SECURITY-EVENT-LOG/.*[4-5].dat
|
||
security.sources.s2.filegroups.f7 = /home/data/192.168.60.107/SECURITY-EVENT-LOG/.*[4-5].dat
|
||
security.sources.s2.filegroups.f8 = /home/data/192.168.60.108/SECURITY-EVENT-LOG/.*[4-5].dat
|
||
security.sources.s2.filegroups.f9 = /home/data/192.168.60.109/SECURITY-EVENT-LOG/.*[4-5].dat
|
||
security.sources.s2.filegroups.f10 = /home/data/192.168.60.110/SECURITY-EVENT-LOG/.*[4-5].dat
|
||
security.sources.s2.filegroups.f11 = /home/data/192.168.60.111/SECURITY-EVENT-LOG/.*[4-5].dat
|
||
security.sources.s2.filegroups.f12 = /home/data/192.168.60.112/SECURITY-EVENT-LOG/.*[4-5].dat
|
||
security.sources.s2.filegroups.f13 = /home/data/192.168.60.113/SECURITY-EVENT-LOG/.*[4-5].dat
|
||
|
||
|
||
security.sources.s2.maxBatchCount = 10000
|
||
|
||
# kafka channel充当生产者
|
||
security.channels.c2.type = org.apache.flume.channel.kafka.KafkaChannel
|
||
security.channels.c2.brokerList = 192.168.40.222:9093
|
||
security.channels.c2.topic = SECURITY-EVENT-LOG
|
||
#false表示是以纯文本的形式写进入的，true是以event的形式写进入的，以event写进入时，会出现乱码， 默认是true
|
||
security.channels.c2.parseAsFlumeEvent = false
|
||
security.channels.c2.kafka.producer.acks = 1
|
||
security.channels.c2.producer.type=sync
|
||
security.channels.c2.queue.buffering.max.ms = 5000
|
||
security.channels.c2.queue.buffering.max.messages=20000
|
||
security.channels.c2.batch.num.messages=5000
|