ELK平台搭建

 部署步骤

部署elasticsearch

linux 新添加用户,然后启动 elasticsearch

./elasticsearch -d

部署 logstash

安装multiline插件

./logstash-plugin install logstash-filter-multiline

# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  file {
    #path =>  ['/home/logs/today/*/INFO.log']
    path =>  ['/data/logs/bee/*/error.2021-07-*.log']
    start_position => "beginning"
  }
}

filter {
    multiline {
        pattern => "^\s" 
        what => "previous"
        }
}


output {
  elasticsearch {
    hosts => ["http://182.254.225.131:9200"]
    index => "today-%{+YYYY.MM.dd}"
    #user => "elastic"
    #password => "changeme"
  }
}

启动logstash

./logstash -f ../config/logstashnew.conf

grok语法说明：https://www.jianshu.com/p/d3042a08eb5e

部署Kibana

添加 elasticsearch 地址

启动命令：

nohup /data/software/kibana-7.13.2-linux-x86_64/bin/kibana &

编写监控程序