搭建ELK日誌分析平臺

（上）—— ELK介紹及搭建 Elasticsearch 分佈式集羣

http://blog.51cto.com/zero01/2079879

 

（下）—— 搭建kibana和logstash服務器

http://blog.51cto.com/zero01/2082794

 

ELK 日誌相關

https://www.cnblogs.com/zhang-shijie/category/803469.html

 

logstash輸出到elasticsearch多索引

https://blog.csdn.net/wangyangzhizhou/article/details/53314022

 

elasticsearch索引自動清理

https://www.cnblogs.com/kasumi/p/6479733.html

 

Logstash處理json格式日誌文件的三種方法

https://blog.csdn.net/jiao_fuyou/article/details/49174269/

 

LogStash的Filter的使用

https://www.cnblogs.com/qq27271609/p/4762562.html

 

 

問題1:

elasticsearch: can not run elasticsearch as root

https://www.cnblogs.com/sandyyeh/p/8413724.html 

 

問題2:

啓動logstash 用-f

./logstash -f ../config/logstash-sample.conf  

 

問題3:

Logstash.conf 不要配置5044的端口

問題4:

目前input只有tags上能帶到輸出裏，能夠作output條件判斷

filter能夠追加處理數據

 

問題5:

Logstash.conf demo

input {
  file {
        path => "/var/log/system.log"
        tags => ["system"]
        #codec => json
        #start_position => "beginning" #從文件開始處讀寫
  }
  file {
        path => "/var/log/kibana.log"
        tags => ["kibana"]
        codec => json
        #start_position => "beginning" #從文件開始處讀寫
  }
}

filter {
        mutate{
                add_field => {
                        "tmp2" => "1"
                }
        }
}

output {
        if "kibana" in [tags] {
                 elasticsearch {
                         hosts => ["http://127.0.0.1:9200"]
                         index => "kibana.log"
                }
       }
       if "system" in [tags] {
                elasticsearch {
                         hosts => ["http://127.0.0.1:9200"]
                         index => "system.log"
                }
       }

        #elasticsearch {
        #                hosts => ["http://127.0.0.1:9200"]
        #                index => [id]
        #}
        stdout {
                codec => rubydebug
        }
}