ELK-安裝logstash

注意：在下載tar包的時候須要注意下安裝的es版本號，按照官網的說明版本是對應一致的。

$ wget https://artifacts.elastic.co/downloads/logstash/logstash-6.2.2.tar.gz
$ tar -zxvf logstash-6.2.2.tar.gz

$ cd logstash-6.2.2

快速啓動(須要java8 jre，目前不支持java9)
$ ./bin/logstash -e 'input {stdin {}} output {stdout {}}'

安裝logstash-input-jdbc
$ cd /home/es/logstash-6.2.2/bin
$ ./logstash-plugin install logstash-input-jdbc

新建數據庫，並添加增量測試數據

CREATE TABLE `tb_test` (
  `id` bigint(20) NOT NULL AUTO_INCREMENT,
  `name` varchar(50) DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 

logstash config下新建jdbc.conf:
$ cd /home/es/logstash-6.2.2/config
$ vim jdbc.conf

#jdbc.conf內容以下

input { stdin{ } jdbc { jdbc_connection_string => "jdbc:mysql://127.0.0.1:3306/elk?characterEncoding=UTF-8&useSSL=false" jdbc_user => "erp_test" jdbc_password => "erp_test@abc" jdbc_driver_library => "/home/es/logstash-6.2.2/lib/mysql-connector-java-5.1.46.jar" jdbc_driver_class => "com.mysql.jdbc.Driver" jdbc_paging_enabled => "true" jdbc_page_size => "10000" statement => "select * from tb_test" schedule => "* * * * *" type => "jbh_show" } } filter { json { source => "message" remove_field => ["message"] } } output { elasticsearch { hosts => ["localhost:9200"] index => "cmscontent" document_id => "%{id}" } stdout { codec => json_lines } }

 

執行命令啓動
$ cd /home/es/logstash-6.2.2/bin
$ ./logstash -f ../config/jdbc.conf