ELK 学习笔记之 Logstash之output配置

Logstash之output配置:

 

输出到file

配置conf:

input{

       file{

              path => "/usr/local/logstash-5.6.1/bin/spark-test-log.log"

              type => "sparkfile"

              start_position => "beginning"

       }

}

filter{

       grok{

              patterns_dir => '/usr/local/logstash-5.6.1/patterns/selfpattern'

              match => ["message", "%{DATE:date} %{SKYTIME:time} %{LOGLEVEL:loglevel} %{WORD:word}"]

       }

}

output{

       file{

              path => "/tmp/%{+YYYY.MM.dd}-%{host}-file.txt"

       }

}

运行，生成了文件：

文件里记录了数据：

 

输出到elasticsearch

配置conf:

input{

       file{

              path => "/usr/local/logstash-5.6.1/bin/spark-test-log.log"

              type => "sparkfile"

              start_position => "beginning"

       }

}

filter{

       grok{

              patterns_dir => '/usr/local/logstash-5.6.1/patterns/selfpattern'

              match => ["message", "%{DATE:date} %{SKYTIME:time} %{LOGLEVEL:loglevel} %{WORD:word}"]

       }

}

output{

       elasticsearch{

              hosts => ["http://192.168.1.151:9200"]

              index => "logstash_output-%{type}-%{+YYYY.MM.dd}"

              document_type => "sparkfileType"

       }

}

在es head 上可以看到index已经插入成功：

 

转载于:https://www.cnblogs.com/AK47Sonic/p/7586668.html