Logstash: 第一次體驗記錄

Logstash的基本骨架

一個 Logstash 配置的基本組件包括, input, codec, filter, output, 其中過濾器filter, codec不是必須的.

下載須要的軟件包

wget https://download.elastic.co/elasticsearch/release/org/elasticsearch/distribution/tar/elasticsearch/2.3.3/elasticsearch-2.3.3.tar.gz
wget https://download.elastic.co/logstash/logstash/logstash-all-plugins-2.3.1.tar.gz
wget https://download.elastic.co/kibana/kibana/kibana-4.5.1-linux-x64.tar.gz

一個基本的配置,用於解析Apache日誌

input {
    file {
        path => "/home/ycc/elk/configs/logstash-tutorial.log"
        start_position => beginning
    }
}
filter {
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
    }
    geoip {
        source => "clientip"
    }
}
output {
    elasticsearch {
        hosts => "192.168.212.129:9200"
    }
    stdout {}
}

啓動 Elastic Search

/home/ycc/elk/elasticsearch-2.3.3/bin/elasticsearch --network.host 192.168.212.129 --http.port 9200

啓動 Logstash

/home/ycc/elk/logstash-2.3.1/bin/logstash -f /home/ycc/elk/configs/first-pipeline.conf

樣本數據: https://download.elastic.co/demos/logstash/gettingstarted/logstash-tutorial.log.gz

查詢例子