kibana應用 logstash應用

時間  2019-11-14
標籤 kibana 應用 logstash 欄目 日誌分析 简体版
原文   原文鏈接
Top

NSD ARCHITECTURE DAY04

  1. 案例1：導入數據
  2. 案例2：綜合練習

1 案例1：導入數據

1.1 問題

本案例要求批量導入數據：css

  • 批量導入數據並查看

1.2 步驟

實現此案例須要按照以下步驟進行。html

步驟一：導入數據java

使用POST方式批量導入數據，數據格式爲json，url 編碼使用data-binary導入含有index配置的json文件git

  1. [root@room9pc01 ~]# scp /var/ftp/elk/*.gz 192.168.1.66:/root/
  2. [root@kibana ~]# gzip -d logs.jsonl.gz
  3. [root@kibana ~]# gzip -d accounts.json.gz
  4. [root@kibana ~]# gzip -d shakespeare.json.gz
  5. [root@kibana ~]# curl -X POST "http://192.168.1.61:9200/_bulk" \
  6. --data-binary @shakespeare.json
  7. [root@kibana ~]# curl -X POST "http://192.168.1.61:9200/xixi/haha/_bulk" \
  8. --data-binary @accounts.json
  9. //索引是xixi，類型是haha，必須導入索引和類型，沒有索引，要加上
  10. [root@kibana ~]# curl -X POST "http://192.168.1.61:9200/_bulk" \
  11. --data-binary @logs.jsonl

2）使用GET查詢結果github

  1. [root@kibana ~]# curl -XGET 'http://192.168.1.61:9200/_mget?pretty' -d '{
  2. "docs":[
  3. {
  4. "_index":"shakespeare",
  5. "_type:":"act",
  6. "_id":0
  7. },
  8. {
  9. "_index":"shakespeare",
  10. "_type:":"line",
  11. "_id":0
  12. },
  13. {
  14. "_index":"xixi",
  15. "_type:":"haha",
  16. "_id":25
  17. }
  18. ]
  19. }'
  20. {        //查詢的結果
  21. "docs" : [ {
  22. "_index" : "shakespeare",
  23. "_type" : "act",
  24. "_id" : "0",
  25. "_version" : 1,
  26. "found" : true,
  27. "_source" : {
  28. "line_id" : 1,
  29. "play_name" : "Henry IV",
  30. "speech_number" : "",
  31. "line_number" : "",
  32. "speaker" : "",
  33. "text_entry" : "ACT I"
  34. }
  35. }, {
  36. "_index" : "shakespeare",
  37. "_type" : "act",
  38. "_id" : "0",
  39. "_version" : 1,
  40. "found" : true,
  41. "_source" : {
  42. "line_id" : 1,
  43. "play_name" : "Henry IV",
  44. "speech_number" : "",
  45. "line_number" : "",
  46. "speaker" : "",
  47. "text_entry" : "ACT I"
  48. }
  49. }, {
  50. "_index" : "xixi",
  51. "_type" : "haha",
  52. "_id" : "25",
  53. "_version" : 1,
  54. "found" : true,
  55. "_source" : {
  56. "account_number" : 25,
  57. "balance" : 40540,
  58. "firstname" : "Virginia",
  59. "lastname" : "Ayala",
  60. "age" : 39,
  61. "gender" : "F",
  62. "address" : "171 Putnam Avenue",
  63. "employer" : "Filodyne",
  64. "email" : "virginiaayala@filodyne.com",
  65. "city" : "Nicholson",
  66. "state" : "PA"
  67. }
  68. } ]
  69. }

步驟二：使用kibana查看數據是否導入成功正則表達式

1）數據導入之後查看logs是否導入成功，如圖-1所示：apache

  1. [root@se5 ~]# firefox http://192.168.1.65:9200/_plugin/head/

圖-1json

2）kibana導入數據，如圖-2所示：vim

  1. [root@kibana ~]# firefox http://192.168.1.66:5601

圖-2瀏覽器

3）成功建立會有logstash-*，如圖-3所示：

/

圖-3

4）導入成功以後選擇Discover，如圖-4所示：

圖-4

注意： 這裏沒有數據的緣由是導入日誌的時間段不對，默認配置是最近15分鐘，在這能夠修改一下時間來顯示

5）kibana修改時間，選擇Lsat 15 miuntes，如圖-5所示：

圖-5

6）選擇Absolute，如圖-6所示：

圖-6

7）選擇時間2015-5-15到2015-5-22，如圖-7所示：

圖-7

8）查看結果，如圖-8所示：

圖-8

9）除了柱狀圖，Kibana還支持不少種展現方式 ，如圖-9所示：

圖-9

10）作一個餅圖，選擇Pie chart，如圖-10所示：

圖-10

11）選擇from a new serach，如圖-11所示：

圖-11

12）選擇Spilt Slices，如圖-12所示：

圖-12

13）選擇Trems,Memary(也能夠選擇其餘的，這個不固定)，如圖-13所示：

圖-13

14）結果，如圖-14所示：

圖-14

15）保存後能夠在Dashboard查看，如圖-15所示：

圖-15

2 案例2：綜合練習

2.1 問題

本案例要求：

  • 練習插件
  • 安裝一臺Apache服務並配置
  • 使用filebeat收集Apache服務器的日誌
  • 使用grok處理filebeat發送過來的日誌
  • 存入elasticsearch

2.2 步驟

實現此案例須要按照以下步驟進行。

步驟一：安裝logstash

1）配置主機名，ip和yum源，配置/etc/hosts（請把se1-se5和kibana主機配置和logstash同樣的/etc/hosts）

  1. [root@logstash ~]# vim /etc/hosts
  2. 192.168.1.61 se1
  3. 192.168.1.62 se2
  4. 192.168.1.63 se3
  5. 192.168.1.64 se4
  6. 192.168.1.65 se5
  7. 192.168.1.66 kibana
  8. 192.168.1.67 logstash

2）安裝java-1.8.0-openjdk和logstash

  1. [root@logstash ~]# yum -y install java-1.8.0-openjdk
  2. [root@logstash ~]# yum -y install logstash
  3. [root@logstash ~]# java -version
  4. openjdk version "1.8.0_131"
  5. OpenJDK Runtime Environment (build 1.8.0_131-b12)
  6. OpenJDK 64-Bit Server VM (build 25.131-b12, mixed mode)
  7. [root@logstash ~]# touch /etc/logstash/logstash.conf
  8. [root@logstash ~]# /opt/logstash/bin/logstash --version
  9. logstash 2.3.4
  10. [root@logstash ~]# /opt/logstash/bin/logstash-plugin list //查看插件
  11. ...
  12. logstash-input-stdin    //標準輸入插件
  13. logstash-output-stdout    //標準輸出插件
  14. ...
  15. [root@logstash ~]# vim /etc/logstash/logstash.conf
  16. input{
  17. stdin{
  19. }
  20. }
  22. filter{
  24. }
  26. output{
  27. stdout{
  29. }
  30. }
  32. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  33. //啓動並測試
  34. Settings: Default pipeline workers: 2
  35. Pipeline main started
  36. aa        //logstash 配置從標準輸入讀取輸入源,而後從標準輸出輸出到屏幕
  37. 2018-09-15T06:19:28.724Z logstash aa

備註：若不會寫配置文件能夠找幫助，插件文檔的位置：

https://github.com/logstash-plugins

3）codec類插件

  1. [root@logstash ~]# vim /etc/logstash/logstash.conf
  2. input{
  3. stdin{
  4. codec => "json"        //輸入設置爲編碼json
  5. }
  6. }
  8. filter{
  10. }
  12. output{
  13. stdout{
  14. codec => "rubydebug"        //輸出設置爲rubydebug
  15. }
  16. }
  17. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  18. Settings: Default pipeline workers: 2
  19. Pipeline main started
  20. {"a":1}
  21. {
  22. "a" => 1,
  23. "@version" => "1",
  24. "@timestamp" => "2018-09-15T06:34:14.538Z",
  25. "host" => "logstash"
  26. }

4）file模塊插件

  1. [root@logstash ~]# vim /etc/logstash/logstash.conf
  2. input{
  3. file {
  4. path => [ "/tmp/a.log", "/var/tmp/b.log" ]
  5. sincedb_path => "/var/lib/logstash/sincedb"    //記錄讀取文件的位置
  6. start_position => "beginning"                //配置第一次讀取文件從什麼地方開始
  7. type => "testlog"                    //類型名稱
  8. }
  9. }
  11. filter{
  13. }
  15. output{
  16. stdout{
  17. codec => "rubydebug"
  18. }
  19. }
  21. [root@logstash ~]# touch /tmp/a.log
  22. [root@logstash ~]# touch /var/tmp/b.log
  23. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf

另開一個終端：寫入數據

  1. [root@logstash ~]# echo a1 > /tmp/a.log
  2. [root@logstash ~]# echo b1 > /var/tmp/b.log

以前終端查看：

  1. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  2. Settings: Default pipeline workers: 2
  3. Pipeline main started
  4. {
  5. "message" => "a1",
  6. "@version" => "1",
  7. "@timestamp" => "2018-09-15T06:44:30.671Z",
  8. "path" => "/tmp/a.log",
  9. "host" => "logstash",
  10. "type" => "testlog"
  11. }
  12. {
  13. "message" => "b1",
  14. "@version" => "1",
  15. "@timestamp" => "2018-09-15T06:45:04.725Z",
  16. "path" => "/var/tmp/b.log",
  17. "host" => "logstash",
  18. "type" => "testlog"
  19. }
  20.     

5）tcp、udp模塊插件

  1. [root@logstash ~]# vim /etc/logstash/logstash.conf
  2. input{
  3. file {
  4. path => [ "/tmp/a.log", "/var/tmp/b.log" ]
  5. sincedb_path => "/var/lib/logstash/sincedb"
  6. start_position => "beginning"
  7. type => "testlog"
  8. }
  9. tcp {
  10. host => "0.0.0.0"
  11. port => "8888"
  12. type => "tcplog"
  13. }
  14. udp {
  15. host => "0.0.0.0"
  16. port => "9999"
  17. type => "udplog"
  18. }
  19. }
  21. filter{
  23. }
  24. output{
  25. stdout{
  26. codec => "rubydebug"
  27. }
  28. }
  29. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  30. //啓動

另開一個終端查看，能夠看到端口

  1. [root@logstash tmp]# netstat -antup | grep 8888
  2. tcp6 0 0 :::8888 :::* LISTEN 22191/java
  3. [root@logstash tmp]# netstat -antup | grep 9999
  4. udp6 0 0 :::9999 :::* 22191/java

在另外一臺主機上寫一個腳本，發送數據，使啓動的logstash能夠接收到數據

  1. [root@se5 ~]# vim tcp.sh
  2. function sendmsg(){
  3. if [[ "$1" == "tcp" ]];then
  4. exec 9<>/dev/tcp/192.168.1.67/8888
  5. else
  6. exec 9<>/dev/udp/192.168.1.67/9999
  7. fi
  8. echo "$2" >&9
  9. exec 9<&-
  10. }
  11. [root@se5 ~]# . tcp.sh        //從新載入一下
  12. [root@se5 ~]# sendmsg udp "is tcp test"
  13. [root@se5 ~]# sendmsg udp "is tcp ss"

logstash主機查看結果

  1. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  2. Settings: Default pipeline workers: 2
  3. Pipeline main started
  4. {
  5. "message" => "is tcp test\n",
  6. "@version" => "1",
  7. "@timestamp" => "2018-09-15T07:45:00.638Z",
  8. "type" => "udplog",
  9. "host" => "192.168.1.65"
  10. }
  11. {
  12. "message" => "is tcp ss\n",
  13. "@version" => "1",
  14. "@timestamp" => "2018-09-15T07:45:08.897Z",
  15. "type" => "udplog",
  16. "host" => "192.168.1.65"
  17. }

6）syslog插件練習

  1. [root@logstash ~]# systemctl list-unit-files | grep syslog
  2. rsyslog.service enabled
  3. syslog.socket static
  4. [root@logstash ~]# vim /etc/logstash/logstash.conf
  5. start_position => "beginning"
  6. type => "testlog"
  7. }
  8. tcp {
  9. host => "0.0.0.0"
  10. port => "8888"
  11. type => "tcplog"
  12. }
  13. udp {
  14. host => "0.0.0.0"
  15. port => "9999"
  16. type => "udplog"
  17. }
  18. syslog {
  19. port => "514"
  20. type => "syslog"
  21. }
  22. }
  24. filter{
  26. }
  28. output{
  29. stdout{
  30. codec => "rubydebug"
  31. }
  32. }

另外一個終端查看是否檢測到514

  1. [root@logstash ~]# netstat -antup | grep 514
  2. tcp6 0 0 :::514 :::* LISTEN 22728/java
  3. udp6 0 0 :::514 :::* 22728/java

另外一臺主機上面操做,本地寫的日誌本地能夠查看

  1. [root@se5 ~]# vim /etc/rsyslog.conf
  2. local0.info /var/log/mylog //本身添加這一行
  3. [root@se5 ~]# systemctl restart rsyslog    //重啓rsyslog
  4. [root@se5 ~]# ll /var/log/mylog        //提示沒有那個文件或目錄
  5. ls: cannot access /var/log/mylog: No such file or directory
  6. [root@se5 ~]# logger -p local0.info -t nsd "elk"        //寫日誌
  7. [root@se5 ~]# ll /var/log/mylog        //再次查看，有文件
  8. -rw------- 1 root root 29 Sep 15 16:23 /var/log/mylog
  9. [root@se5 ~]# tail /var/log/mylog //能夠查看到寫的日誌
  10. Sep 15 16:23:25 se5 nsd: elk
  11. [root@se5 ~]# tail /var/log/messages
  12. //能夠查看到寫的日誌，由於配置文件裏有寫以.info結尾的能夠收到
  13. ...
  14. Sep 15 16:23:25 se5 nsd: elk

把本地的日誌發送給遠程1.67

  1. [root@se5 ~]# vim /etc/rsyslog.conf
  2. local0.info @192.168.1.67:514
  3. //寫一個@或兩個@@均可以，一個@表明udp，兩個@@表明tcp
  4. [root@se5 ~]# systemctl restart rsyslog
  5. [root@se5 ~]# logger -p local0.info -t nds "001 elk"
  6. [root@logstash bin]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  7. //檢測到寫的日誌
  8. {
  9. "message" => "001 elk",
  10. "@version" => "1",
  11. "@timestamp" => "2018-09-05T09:15:47.000Z",
  12. "type" => "syslog",
  13. "host" => "192.168.1.65",
  14. "priority" => 134,
  15. "timestamp" => "Jun 5 17:15:47",
  16. "logsource" => "kibana",
  17. "program" => "nds1801",
  18. "severity" => 6,
  19. "facility" => 16,
  20. "facility_label" => "local0",
  21. "severity_label" => "Informational"
  22. }

rsyslog.conf配置向遠程發送數據，遠程登錄1.65的時侯，把登錄日誌的信息（/var/log/secure）轉發給logstash即1.67這臺機器

  1. [root@se5 ~]# vim /etc/rsyslog.conf
  2. 57 authpriv.* @@192.168.1.67:514
  3. //57行的/var/log/secure改成@@192.168.1.67:514
  4. [root@se5 ~]# systemctl restart rsyslog
  5. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  6. //找一臺主機登陸1.65，logstash主機會有數據
  7. Settings: Default pipeline workers: 2
  8. Pipeline main started
  9. {
  10. "message" => "Accepted password for root from 192.168.1.254 port 33780 ssh2\n",
  11. "@version" => "1",
  12. "@timestamp" => "2018-09-15T08:40:57.000Z",
  13. "type" => "syslog",
  14. "host" => "192.168.1.65",
  15. "priority" => 86,
  16. "timestamp" => "Sep 15 16:40:57",
  17. "logsource" => "se5",
  18. "program" => "sshd",
  19. "pid" => "26133",
  20. "severity" => 6,
  21. "facility" => 10,
  22. "facility_label" => "security/authorization",
  23. "severity_label" => "Informational"
  24. }
  25. {
  26. "message" => "pam_unix(sshd:session): session opened for user root by (uid=0)\n",
  27. "@version" => "1",
  28. "@timestamp" => "2018-09-15T08:40:57.000Z",
  29. "type" => "syslog",
  30. "host" => "192.168.1.65",
  31. "priority" => 86,
  32. "timestamp" => "Sep 15 16:40:57",
  33. "logsource" => "se5",
  34. "program" => "sshd",
  35. "pid" => "26133",
  36. "severity" => 6,
  37. "facility" => 10,
  38. "facility_label" => "security/authorization",
  39. "severity_label" => "Informational"

7）filter grok插件

grok插件：

解析各類非結構化的日誌數據插件

grok使用正則表達式把飛結構化的數據結構化

在分組匹配，正則表達式須要根據具體數據結構編寫

雖然編寫困難，但適用性極廣

  1. [root@logstash ~]# vim /etc/logstash/logstash.conf
  2. input{
  3. stdin{ codec => "json" }
  4. file {
  5. path => [ "/tmp/a.log", "/var/tmp/b.log" ]
  6. sincedb_path => "/var/lib/logstash/sincedb"
  7. start_position => "beginning"
  8. type => "testlog"
  9. }
  10. tcp {
  11. host => "0.0.0.0"
  12. port => "8888"
  13. type => "tcplog"
  14. }
  15. udp {
  16. host => "0.0.0.0"
  17. port => "9999"
  18. type => "udplog"
  19. }
  20. syslog {
  21. port => "514"
  22. type => "syslog"
  23. }
  24. }
  26. filter{
  27. grok{
  28. match => ["message", "(?<key>reg)"]
  29. }
  30. }
  32. output{
  33. stdout{
  34. codec => "rubydebug"
  35. }
  36. }
  37. [root@se5 ~]# yum -y install httpd
  38. [root@se5 ~]# systemctl restart httpd
  39. [root@se5 ~]# vim /var/log/httpd/access_log
  40. 192.168.1.254 - - [15/Sep/2018:18:25:46 +0800] "GET / HTTP/1.1" 403 4897 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"

複製/var/log/httpd/access_log的日誌到logstash下的/tmp/a.log

  1. [root@logstash ~]# vim /tmp/a.log
  2. 192.168.1.254 - - [15/Sep/2018:18:25:46 +0800] "GET / HTTP/1.1" 403 4897 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0"
  4. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  5. //出現message的日誌，可是沒有解析是什麼意思
  6. Settings: Default pipeline workers: 2
  7. Pipeline main started
  8. {
  9. "message" => ".168.1.254 - - [15/Sep/2018:18:25:46 +0800] \"GET / HTTP/1.1\" 403 4897 \"-\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0\"",
  10. "@version" => "1",
  11. "@timestamp" => "2018-09-15T10:26:51.335Z",
  12. "path" => "/tmp/a.log",
  13. "host" => "logstash",
  14. "type" => "testlog",
  15. "tags" => [
  16. [0] "_grokparsefailure"
  17. ]
  18. }

若要解決沒有解析的問題，一樣的方法把日誌複製到/tmp/a.log，logstash.conf配置文件裏面修改grok

查找正則宏路徑

  1. [root@logstash ~]# cd /opt/logstash/vendor/bundle/ \
  2. jruby/1.9/gems/logstash-patterns-core-2.0.5/patterns/
  3. [root@logstash ~]# vim grok-patterns //查找COMBINEDAPACHELOG
  4. COMBINEDAPACHELOG %{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}
  6. [root@logstash ~]# vim /etc/logstash/logstash.conf
  7. ...
  8. filter{
  9. grok{
  10. match => ["message", "%{COMBINEDAPACHELOG}"]
  11. }
  12. }
  13. ...

解析出的結果

  1. [root@logstash ~]# /opt/logstash/bin/logstash -f /etc/logstash/logstash.conf
  2. Settings: Default pipeline workers: 2
  3. Pipeline main started
  4. {
  5. "message" => "192.168.1.254 - - [15/Sep/2018:18:25:46 +0800] \"GET /noindex/css/open-sans.css HTTP/1.1\" 200 5081 \"http://192.168.1.65/\" \"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0\"",
  6. "@version" => "1",
  7. "@timestamp" => "2018-09-15T10:55:57.743Z",
  8. "path" => "/tmp/a.log",
  9. "host" => "logstash",
  10. "type" => "testlog",
  11. "clientip" => "192.168.1.254",
  12. "ident" => "-",
  13. "auth" => "-",
  14. "timestamp" => "15/Sep/2018:18:25:46 +0800",
  15. "verb" => "GET",
  16. "request" => "/noindex/css/open-sans.css",
  17. "httpversion" => "1.1",
  18. "response" => "200",
  19. "bytes" => "5081",
  20. "referrer" => "\"http://192.168.1.65/\"",
  21. "agent" => "\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0\""
  22. }

步驟二：安裝Apache服務，用filebeat收集Apache服務器的日誌，存入elasticsearch

1）在以前安裝了Apache的主機上面安裝filebeat

  1. [root@se5 ~]# yum -y install filebeat
  2. [root@se5 ~]# vim/etc/filebeat/filebeat.yml
  3. paths:
  4.     - /var/log/httpd/access_log //日誌的路徑，短橫線加空格表明yml格式
  5. document_type: apachelog //文檔類型
  6. elasticsearch:        //加上註釋
  7. hosts: ["localhost:9200"]                //加上註釋
  8. logstash:                    //去掉註釋
  9. hosts: ["192.168.1.67:5044"]     //去掉註釋,logstash那臺主機的ip
  10. [root@se5 ~]# systemctl start filebeat
  12. [root@logstash ~]# vim /etc/logstash/logstash.conf
  13. input{
  14. stdin{ codec => "json" }
  15. beats{
  16. port => 5044
  17. }
  18. file {
  19. path => [ "/tmp/a.log", "/var/tmp/b.log" ]
  20. sincedb_path => "/dev/null"
  21. start_position => "beginning"
  22. type => "testlog"
  23. }
  24. tcp {
  25. host => "0.0.0.0"
  26. port => "8888"
  27. type => "tcplog"
  28. }
  29. udp {
  30. host => "0.0.0.0"
  31. port => "9999"
  32. type => "udplog"
  33. }
  34. syslog {
  35. port => "514"
  36. type => "syslog"
  37. }
  38. }
  40. filter{
  41. if [type] == "apachelog"{
  42. grok{
  43. match => ["message", "%{COMBINEDAPACHELOG}"]
  44. }}
  45. }
  47. output{
  48. stdout{ codec => "rubydebug" }
  49. if [type] == "filelog"{
  50. elasticsearch {
  51. hosts => ["192.168.1.61:9200", "192.168.1.62:9200"]
  52. index => "filelog"
  53. flush_size => 2000
  54. idle_flush_time => 10
  55. }}
  56. }
  57. [root@logstash logstash]# /opt/logstash/bin/logstash \
  58. -f /etc/logstash/logstash.conf

打開另外一終端查看5044是否成功啓動

  1. [root@logstash ~]# netstat -antup | grep 5044
  2. tcp6 0 0 :::5044 :::* LISTEN 23776/java
  4. [root@se5 ~]# firefox 192.168.1.65 //ip爲安裝filebeat的那臺機器

回到原來的終端，有數據

2）修改logstash.conf文件

  1. [root@logstash logstash]# vim logstash.conf
  2. ...
  3. output{
  4. stdout{ codec => "rubydebug" }
  5. if [type] == "apachelog"{
  6. elasticsearch {
  7. hosts => ["192.168.1.61:9200", "192.168.1.62:9200"]
  8. index => "apachelog"
  9. flush_size => 2000
  10. idle_flush_time => 10
  11. }}
  12. }

瀏覽器訪問Elasticsearch，有apachelog，如圖-16所示：

圖-16

相關文章
相關標籤/搜索
每日一句
    每一个你不满意的现在，都有一个你没有努力的曾经。
本站公眾號
   歡迎關注本站公眾號,獲取更多信息
聯繫我們 最近搜索 最新文章 沪ICP备13005482号-10 MyBatis教程 SQL 教程 MySQL教程 Java 教程 Thymeleaf 教程 Hibernate教程 Spring教程 Redis教程