logstash 安裝與啓動

官網下載

https://www.elastic.co/cn/products/logstash

在logstash/config目錄建立配置文件logstash.config內容以下

#配置收集規則
input {
  stdin {}
}


#配置過濾規則
filter {
    grok {
        match => {
            "message" => "%{WORD} %{IP:client} %{WORD}"
        }
    }
}
#配置輸出規則
output {
     elasticsearch {
                hosts => ["10.116.69.4:9200" ]
                action => "index"
                codec => rubydebug
                index => "%{type}-%{+YYYY.MM.dd}"
                template_name => "%{type}"
        }
}

啓動

nohup ./bin/logstash -f logstash.config &>nohup.log&