logstash 执行命令

logstash 执行命令

1.解压

2.修改配置文件
logstash安装目录的config目录下，新建一个jiayou.conf文件,内容如下：
input {
  file {
    path => ["/home/es01/es8/jiayou/shuju/*"]  
    start_position => "beginning"
    #codec => json
    sincedb_path => "/dev/null"
  }
}
filter {
   csv {
    separator => ","
     columns => ["省","市","县","加油站名称","油罐","加油罐次数","油号","加油机","机油枪","单件","加油量","现有油量","加油开始时间","加油结束时间","客户姓名","客户电话","lat","lon"]
     }
    #将经纬度合并成数组
    mutate {
        add_field => ["[location]", "%{lon}"]
        add_field => ["[location]", "%{lat}"]
    }
    #将数组内数据格式转换成float数据类型
    mutate {
        convert => ["[location]", "float"]
    }
    #删除无效的字段
    mutate {
        remove_field => "lon"
        remove_field => "lat"
    }
mutate {
 remove_field => ["@version","message","host","path","log","event"]
}
}
output {
  elasticsearch {
        hosts => ["es的ip地址:端口号"]
        index => "jiayou"
    cacert => "/home/es01/es8/es01/config/certs/elasticsearch-ca.pem"
    user => "elastic"
        password => "linuxlinux"
  }
}
 

3.测试conf文件是否有问题
./logstash -f ../config/jiayou.conf  -t

4.启动logstash
./logstash -f ../config/jiayou.conf --config.reload.automatic