无线考勤实现

1. 配置华为控制器，启用 SysLog

   
   配置华为SysLog

2. 使用 Logstash 实现日志收集

input {
  syslog {
    port => "514"
    codec => plain { charset => "UTF-8" }
  }
}
filter {
  grok {
    match => [
      "message", ".*?The user log was created\.  user=%{QS:user} ip=%{QS:ip} radiusclientip=%{QS:client} msgtype=%{QS:msgtype} time=%{QS:time} mac=%{QS:mac}"
    ]
  }
  if "_grokparsefailure" in [tags] {
    drop { }
  }
}
output {
  elasticsearch {
    hosts => [ "elastic:9200" ]
    index => "agile"
  }
}

3. 使用 Elastic 进行日志分析

   
   上下线消息日志.png