第一种:
通过官网logstash包下载安装 https://artifacts.elastic.co/downloads/logstash/logstash-7.10.1-linux-aarch64.tar.gz
解压在mnt目录下
修改配置文件.conf
cd /mnt/logstash-7.10.1
bin/logstash -f config/logstash-sample.conf -t 检测配置文件
bin/logstash -f config/logstash-sample.conf >/dev/null 2>log & 后台启动
日志在 /mnt/logstash-7.10.1/logs
input { stdin { } }
output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}
bin/logstash -f logstash-simple.conf
第二种: docker 安装
https://www.elastic.co/cn/downloads/logstash
https://artifacts.elastic.co/downloads/logstash/logstash-7.10.1-linux-aarch64.tar.gz
yum: command not found
使用docker 安装Logstash,来收集文件/var/log/messages
https://blog.csdn.net/shykevin/article/details/108251996
5044 9600
docker pull wep4you/logstash:7.9.2
docker run -d --name=logstash wep4you/logstash:7.9.2
等待30秒,查看日志
docker logs -f logstash
mkdir -p /mnt/docker/elk7/logstash/config/conf.d
docker cp logstash:/usr/share/logstash/config /mnt/docker/elk7/logstash/
docker cp logstash:/usr/share/logstash/data /mnt/docker/elk7/logstash/
docker cp logstash:/usr/share/logstash/pipeline /mnt/docker/elk7/logstash/
chmod 777 -R /mnt/docker/elk7/logstash
vim /mnt/docker/elk7/logstash/config/logstash.yml
http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.hosts: [ "http://139.9.53.103:9200" ]
path.config: /usr/share/logstash/config/conf.d/*.conf
path.logs: /usr/share/logstash/logs
vim /mnt/docker/elk7/logstash/config/conf.d/syslog.conf
input {
file {
#标签
type => "systemlog-localhost"
#采集点
path => "/var/log/messages"
#开始收集点
start_position => "beginning"
#扫描间隔时间,默认是1s,建议5s
stat_interval => "5"
}
}
output {
elasticsearch {
hosts => ["您的ip:9200"]
index => "logstash-system-localhost-%{+YYYY.MM.dd}"
}
}
docker rm -f logstash 强制删除一个运行中的日容器
chmod 644 /var/log/messages
docker run -d -p 5044:5044 --name=logstash --restart=always -v /mnt/docker/elk7/logstash:/usr/share/logstash -v /var/log/messages:/var/log/messages wep4you/logstash:7.9.2
docker run -d --restart=always --log-driver json-file --log-opt max-size=100m --log-opt max-file=2 -p 5044:5044 --name xinyar-logstash -v /data/elk/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml -v /data/elk/logstash/conf.d/:/usr/share/logstash/conf.d/ logstash:7.4.1
docker exec -it logstash /bin/bash