logstash安装

logstash安装

从kafka接收数据，并发送到ElasticSearch

采集数据有java应用程序日志、consul日志

1、 机器准备

建议配置：4CPU 4G内存

2. 安装jdk1.8

https://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html

rpm -ivh jdk-8u231-linux-x64.rpm

[root@logstash patterns]# java -version

java version "1.8.0_231"

Java(TM) SE Runtime Environment (build 1.8.0_231-b11)

Java HotSpot(TM) 64-Bit Server VM (build 25.231-b11, mixed mode)

3. 下载安装包

wget https://artifacts.elastic.co/downloads/logstash/logstash-6.3.1.rpm

4、安装

rpm -ivh logstash-6.3.1.rpm

5、修改配置

• 1、修改日志输出目录

mkdir -p /data/logs/logstash
chown -R logstash.logstash /data/logs/logstash/

vim /etc/logstash/logstash.yml

path.logs: /data/logs/logstash

• 2、配置清理历史日志规则

vim /etc/logstash/log4j2.properties

加入如下内容，用于清理历史日志

appender.rolling.strategy.type = DefaultRolloverStrategy
appender.rolling.strategy.action.type = Delete
appender.rolling.strategy.action.basepath = ${sys:ls.logs}
appender.rolling.strategy.action.condition.type = IfFileName
appender.rolling.strategy.action.condition.glob = ${sys:ls.logs}/logstash-${sys:ls.log.format}
appender.rolling.strategy.action.condition.nested_condition.type = IfLastModified
appender.rolling.strategy.action.condition.nested_condition.age = 7D

6、启动logstash

systemctl start logstash