02

logstash 安装和简单使用

------------------------------------------------

1：安装jdk：

[root@elk03tools]# rpm -ivh jdk-8u221-linux-x64.rpm

warning: jdk-8u221-linux-x64.rpm: Header V3 RSA/SHA256 Signature, key ID ec551f03: NOKEY

Preparing...                          ################################# [100%]

Updating / installing...

   1:jdk1.8-2000:1.8.0_221-fcs        ################################# [100%]

Unpacking JAR files...

2：安装logstash：

[root@elk03tools]# wget https://mirrors.tuna.tsinghua.edu.cn/elasticstack/7.x/yum/7.1.1/logstash-7.1.1.rpm

[root@elk03tools]# yum localinstall -y logstash-7.1.1.rpm

目录授权：

[root@elk03tools]# chown -R logstash.logstash /usr/share/logstash/

3: 测试logstash标准输入到标准输出：

[root@elk03tools]# /usr/share/logstash/bin/logstash -e 'input { stdin{} } output { stdout{ codec => rubydebug }}'

.......

The stdin plugin is now waiting for input:

....启动很慢，请耐心等待，出现input代表启动成功

输入：ggj ，返回：

/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/awesome_print-1.7.0/lib/awesome_print/formatters/base_formatter.rb:31: warning: constant ::Fixnum is deprecated

{

       "message" => "ggj",

    "@timestamp" => 2019-09-06T14:40:22.382Z,

          "host" => "elk126",

      "@version" => "1"

}

4: 测试logstash标准输入到文件：

[root@elk03tools]# /usr/share/logstash/bin/logstash -e 'input { stdin{} } output { file { path => "/tmp/test_%{+YYYY.MM.dd}.log"}}'

.......

输入：

sadsd

[INFO ] 2019-09-06 22:49:51.269 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>125, :thread=>"#<Thread:0x12965992 run>"}

[INFO ] 2019-09-06 22:49:51.835 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}

The stdin plugin is now waiting for input:

[INFO ] 2019-09-06 22:49:52.430 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

[INFO ] 2019-09-06 22:49:56.909 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}

[INFO ] 2019-09-06 22:49:59.934 [[main]>worker0] file - Opening file {:path=>"/tmp/test_2019.09.06.log"}

j[INFO ] 2019-09-06 22:50:13.769 [[main]>worker0] file - Closing file /tmp/test_2019.09.06.log

查看文件是否有刚才输入的内容：

[root@elk03tmp]# cat test_2019.09.06.log

{"@timestamp":"2019-09-06T14:49:52.212Z","host":"elk126","@version":"1","message":"sadsd"}

[root@elk03tmp]#

5: 测试logstash标准输入到es（elasticsearch）：

[root@elk03tools]# /usr/share/logstash/bin/logstash -e 'input { stdin{} } output { elasticsearch { hosts =>["192.168.6.124:9200"] index => "xujin_%{+YYYY.MM.dd}" }}'

.............

The stdin plugin is now waiting for input:

[INFO ] 2019-09-06 22:55:30.818 [Ruby-0-Thread-5: :1] elasticsearch - Installing elasticsearch template to _template/logstash

[INFO ] 2019-09-06 22:55:31.463 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

[INFO ] 2019-09-06 22:55:34.903 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}

xujin test - to  el（输入的内容）