elasticsearch进行日志信息的采集（按照指定格式）

filter表示过滤
终端输入
终端输出stdin
rubydebug 改变输出格式

第一类：储存信息到指定文件

[root@server1 tmp]# cd /etc/logstash/conf.d/
[root@server1 conf.d]# vim message.conf 

input {
        stdin {}
}

output {
        elasticsearch {
                hosts => ["172.25.23.1"]
                index => "logstash-%{+YYYY.MM.dd}"
        }
        file {
                path => "/tmp/demofile
                codec => line { format => "custom format: %{message}"}
        }

}

测试：

~ [root@server1 conf.d]# /opt/logstash/bin/logstash -f /etc/logstash/conf.d/message.conf 
Settings: Default pipeline workers: 1
Pipeline main started
love
{
       "message" => "love",
      "@version" => "1",
    "@timestamp" => "2018-08-25T03:20:25.772Z",
          "host" => "server1"
}
love
{
       "message" => "love",
      "@version" => "1",
    "@timestamp" => "2018-08-25T03:20:28.239Z",
          "host" => "server1"
}
dead
{
       "message" => "dead",
      "@version" => "1",
    "@timestamp" => "2018-08-25T03:20:30.673Z",
          "host" => "server1"
                                                                                   [root@server1 conf.d]# cd /tmp

在文件里指定的目录查找到相应的信息重点内容

[root@server1 tmp]# ls
demo.file  hsperfdata_elasticsearch  hsperfdata_root  jna--1985354563
[root@server1 tmp]# cat demo.file 
custom format: love
custom format: love
custom format: dead
custom format: dead