一、架构图图
![在这里插入图片描述](https://img-blog.csdnimg.cn/20210302230800877.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzIyNjQ4MDkx,size_16,color_FFFFFF,t_70)
配置
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.
input {
# 监听 5044 端口,用于接收 filebeat 输出的日志数据
beats {
port => 5044
}
}
output {
if [@metadata][pipeline] {
if [event][dataset] == "nginx.access" {
elasticsearch {
hosts => ["es01:9200","es02:9200","es03:9200"]
manage_template => false
index => "%{[host][hostname]}-nginx-access-%{+YYYY.MM.dd}"
pipeline => "%{[@metadata][pipeline]}"
}
}else if [event][dataset] == "nginx.error" {
elasticsearch {
hosts => ["es01:9200","es02:9200","es03:9200"]
manage_template => false
index => "%{[host][hostname]}-nginx-error-%{+YYYY.MM.dd}"
pipeline => "%{[@metadata][pipeline]}"
}
}else if [event][dataset] == "mysql.error" {
elasticsearch {
hosts => ["es01:9200","es02:9200","es03:9200"]
manage_template => false
index => "%{[host][hostname]}-mysql-error-%{+YYYY.MM.dd}"
pipeline => "%{[@metadata][pipeline]}"
}
}else if [event][dataset] == "mysql.slowlog" {
elasticsearch {
hosts => ["es01:9200","es02:9200","es03:9200"]
manage_template => false
index => "%{[host][hostname]}-mysql-slowlog-%{+YYYY.MM.dd}"
pipeline => "%{[@metadata][pipeline]}"
}
}
} else {
elasticsearch {
hosts => ["es01:9200","es02:9200","es03:9200"]
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
}
}
}