logstash

第一种：

通过官网logstash包下载安装 https://artifacts.elastic.co/downloads/logstash/logstash-7.10.1-linux-aarch64.tar.gz

解压在mnt目录下

 

修改配置文件.conf

cd /mnt/logstash-7.10.1

bin/logstash -f config/logstash-sample.conf -t   检测配置文件

bin/logstash -f config/logstash-sample.conf >/dev/null 2>log & 后台启动

日志在 /mnt/logstash-7.10.1/logs

 

 

 

 

 

input { stdin { } }
output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}

 

bin/logstash -f logstash-simple.conf

 

 

 

 

第二种： docker 安装

https://www.elastic.co/cn/downloads/logstash
https://artifacts.elastic.co/downloads/logstash/logstash-7.10.1-linux-aarch64.tar.gz
yum: command not found

使用docker 安装Logstash，来收集文件/var/log/messages

https://blog.csdn.net/shykevin/article/details/108251996
5044 9600

docker pull wep4you/logstash:7.9.2

docker run -d --name=logstash wep4you/logstash:7.9.2

等待30秒，查看日志
docker logs -f logstash

mkdir -p /mnt/docker/elk7/logstash/config/conf.d

docker cp logstash:/usr/share/logstash/config /mnt/docker/elk7/logstash/
docker cp logstash:/usr/share/logstash/data /mnt/docker/elk7/logstash/
docker cp logstash:/usr/share/logstash/pipeline /mnt/docker/elk7/logstash/
chmod 777 -R /mnt/docker/elk7/logstash

vim /mnt/docker/elk7/logstash/config/logstash.yml
http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.hosts: [ "http://139.9.53.103:9200" ]
path.config: /usr/share/logstash/config/conf.d/*.conf
path.logs: /usr/share/logstash/logs

vim /mnt/docker/elk7/logstash/config/conf.d/syslog.conf
input {
  file {
    #标签
    type => "systemlog-localhost"
    #采集点
    path => "/var/log/messages"
    #开始收集点
    start_position => "beginning"
    #扫描间隔时间，默认是1s，建议5s
    stat_interval => "5"
  }
}

output {
  elasticsearch {
    hosts => ["您的ip:9200"]
    index => "logstash-system-localhost-%{+YYYY.MM.dd}"
 }
}

docker rm -f logstash  强制删除一个运行中的日容器

chmod 644 /var/log/messages

docker run -d -p 5044:5044 --name=logstash --restart=always -v /mnt/docker/elk7/logstash:/usr/share/logstash -v /var/log/messages:/var/log/messages wep4you/logstash:7.9.2

docker run -d --restart=always --log-driver json-file --log-opt max-size=100m --log-opt max-file=2 -p 5044:5044 --name xinyar-logstash -v /data/elk/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml -v /data/elk/logstash/conf.d/:/usr/share/logstash/conf.d/ logstash:7.4.1
  

docker exec -it logstash /bin/bash