测试Logstash是否正常安装使用
本文的基础是在服务器上已经安装好了Logstash,通过以下的配置对Logstash进行测试。
Logstash的主配置文件介绍:
cat /etc/logstash/logstash.yml
###文件中大部分配置均注释掉了,需要可自行配置,安装完成后,有以下两个配置:
path.data: /var/lib/logstash #数据存储路径
path.logs: /var/log/logstash #日志输出路径
配置Logstash
vim /etc/logstash/conf.d/syslog.conf
--------------------------------------------------------------------
input { # 定义日志源
syslog {
type => "system-syslog" # 定义类型
port => 10010 # 定义监听端口
}
}
output { # 定义日志输出
stdout {
codec => rubydebug # 将日志输出到当前的终端上显示
}
}
测试配置是否正确
# cd 移动到logstash的bin目录下,我的在/usr/share/logstash/bin/
# ./logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/syslog.conf --config.test_and_exit
#####输出
Sending Logstash logs to /var/log/logstash which is now configured via log4j2.properties
[2020-05-07T11:28:25,692][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.queue", :path=>"/var/lib/logstash/queue"}
[2020-05-07T11:28:25,729][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.dead_letter_queue", :path=>"/var/lib/logstash/dead_letter_queue"}
[2020-05-07T11:28:26,270][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-05-07T11:28:26,548][FATAL][logstash.runner ] The given configuration is invalid. Reason: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after
###################或者使用以下命令启动logstash后输入任意字符##########################
# ./logstash -e 'input { stdin { } } output { stdout {codec => rubydebug} }'
如:Hello
返回:
{
"@version" => "1",
"message" => "Hello",
"@timestamp" => 2020-05-07T03:52:26.767Z,
"host" => "iZwz9hs1zswgl6z6euoaflZ"
}
参数说明:
--path.settings : 指定目录,logstash配置文件所在目录
-f : 指定详细的配置文件
--config.test_and_exit : 解析配置文件并报告任何错误
###########################################################
-e 执行操作
input 标准输入
{ input } 插件
output 标准输出
{ stdout } 插件