elk-logstash 读取日志(1): 环境搭建（Windows）

本文链接：https://blog.csdn.net/qq_33834493/article/details/117093816

ES logstash 实现日志文件读取（windows环境）

es版本7.12下载 https://www.elastic.co/cn/downloads/elasticsearch

Logstash 7.12.1下载 https://artifacts.elastic.co/downloads/logstash/logstash-7.12.1-windows-x86_64.zip

es可视化goole浏览器插件：elasticsearch-head-chrome-plugin

ES 安装

解压

双击 bin/elasticsearch启动

启动结果：

浏览器访问：

此时es安装服务启动完成

logstash 安装

解压：

bin 目录下增加 logstash_default.conf ，run_default.bat

logstash_default.conf示例：

input {

file {

path => "D:/SoftWare/elk/info8.log"

type => "elasticsearch"

start_position => "beginning"

}}



filter{

  grok {

    match => { "message" => "%{TIMESTAMP_ISO8601:logdate}" }

  }

  date {

    match => [ "logdate", "YYYY-MM-dd HH:mm:ss.SSS" ]

    target => "@timestamp"

    timezone =>"+00:00"

  }

  mutate{

    remove_field => "logdate"

  }

}

output {

  elasticsearch {

    hosts => ["127.0.0.1:9200"]

    index => "logstash-systemlog-%{+YYYY.MM.dd}"

  }

}

run_default.bat 内容：

logstash -f logstash_default.conf

Google插件安装

读取info8.log 文件内容

2021-05-20 14:26:34.837 [ConsumeMessageThread_4] INFO com.abutment.consumer.ConsumerProcess.lambda$process$2 - 【订阅者Topic: dispatch_topic Tag: GID_TMSJS MessageId: AC1188CD08496B884D5764F234C2DB52】
2021-05-20 14:26:34.837 [ConsumeMessageThread_4] INFO com.abutment.consumer.ConsumerProcess.lambda$process$2 - Start----------------推送信息开始