CentOS 7安装ELK（三）：安装logstash

解压：

tar -xvf logstash-6.6.1.tar.gz

编辑配置文件，/home/elk/logstash-6.6.1/config/logstash.conf，logstash配置文件示例：

    该配置文件使用3个不同端口收集日志并发送到elasticsearch的不同index及控制台。

input {

   tcp {
    type => "cps-trans-gateway"
    host => "192.168.100.181"
    port => 9011
    mode => "server"
    codec => json_lines
   }

   tcp {
    type => "cps-trans-core"
    host => "192.168.100.181"
    port => 9012
    mode => "server"
    codec => json_lines
   }

   tcp {
    type => "cps-trans-router"
    host => "192.168.100.181"
    port => 9013
    mode => "server"
    codec => json_lines
   }

}

output {
   if [type] == "cps-trans-gateway" {
 
    elasticsearch {
      hosts => ["http://192.168.100.181:9200"]
      index => "logs-cps-trans-gateway"
    }

   stdout{} 

  } else if [type] == "cps-trans-core" {
   
    elasticsearch {
      hosts => ["http://192.168.100.181:9200"]
      index => "logs-cps-trans-core"
    }

   stdout{}
  
  } else if [type] == "cps-trans-router" {

    elasticsearch {
      hosts => ["http://192.168.100.181:9200"]
      index => "logs-cps-trans-router"
    }

    stdout{}

  }
}

前台启动：

 /home/elk/logstash-6.6.1/bin/logstash -f /home/elk/logstash-6.6.1/config/logstash.conf

后台启动：

nohup /home/elk/logstash-6.6.1/bin/logstash -f /home/elk/logstash-6.6.1/config/logstash.conf &