Logstash需要安装json_lines插件。
logstash-plugin install logstash-codec-json_lines
在bin目录下面添加文件logstash.conf
配置信息:
input { tcp { mode => "server" host => "0.0.0.0" port => 4560 codec => json_lines type => "debug" } tcp { mode => "server" host => "0.0.0.0" port => 4561 codec => json_lines type => "error" } tcp { mode => "server" host => "0.0.0.0" port => 4562 codec => json_lines type => "business" } tcp { mode => "server" host => "0.0.0.0" port => 4563 codec => json_lines type => "record" } } filter{ if [type] == "record" { mutate { remove_field => "port" remove_field => "host" remove_field => "@version" } json { source => "message" remove_field => ["message"] } } } output { elasticsearch { hosts => "localhost:9200" index => "mall-%{type}-%{+YYYY.MM.dd}" } }
运行bin目录下的logstash.bat
,启动Logstash服务,启动命令如下:
logstash -f logstash.conf