安装Logstash
# tar zxvf logstash-5.4.0.tar.gz
# cp -r logstash-5.4.0 /usr/local/logstash540 或者 mv logstash-5.4.0 logstash540
# cd /usr/local/logstash540/config
# touch logstash.conf
# vim logstash.conf
修改配置文件logstash.conf如下:
input {
file {
path => ["/usr/local/nginx/logs/access.log"]#日志文件存放路径
type => "nginx-access"
start_position => "beginning"
codec => json { charset => "UTF-8" }
sincedb_path => "/usr/local/logstash611/sincedb"#日志文件游标位置
}
}
filter {
}
output {
if [type] == "nginx-access" {
kafka {
bootstrap_servers => "10.1.11.9:9092"#kafka输出地址
topic_id => "zcfTest"#kafka topic容器
codec => json { charset => "UTF-8" }
#compression_type => "snappy"
}
}
}
kafka集群配置
kafka {
bootstrap_servers => "10.1.11.9:9092,10.1.11.10:9092"
topic_id => "luyangTest"
codec => json { charset => "UTF-8" }
#compression_type => "snappy"
}
启动logstash
# cd logstash540
# ./bin/logstash -f logstash.conf