鉴于flume 1.6对于Elasticsearch 2.2支持的不给力,决定用logstash 2.2进行数据采集。
logstash安装
Logstash 2.2.2链接地址
https://www.elastic.co/thank-you?url=https://download.elastic.co/logstash/logstash/logstash-2.2.2.zip
[root@laiym ~]# unzip logstash-2.2.2.zip
[root@laiym ~]# mv logstash-2.2.2 /usr/local/logstash
logstash配置
[root@laiym ~]# cd /usr/local/logstash/
##此处需要翻墙,logstash发送数据到ES,默认使用http协议,如果要使用node和transport协议,下载logstash-output-elasticsearch_java。
[root@laiym ~]# ./bin/plugin install --version 2.0.0logstash-output-elasticsearch_java
[root@laiym logstash]# mkdir conf
[root@laiym logstash]# vim conf/secure-es.conf
#采集linux secure数据,发送到ES上。
input {
file {
path=> "/var/log/secure"
type=> "linux_secure"
}
}
filter {
grok {
match=> { "message" => "%{COMBINEDAPACHELOG}" }
}
date {
match=> [ "timestamp" , "MMM dd HH:mm:ss" ]
}
}
output {
elasticsearch {
hosts=> ["192.168.1.159:9200"]
index=> "linux_secure"
}
stdout { codec => rubydebug }
}
logstash启动
[root@laiym logstash]# ./bin/logstash -f conf/secure-es.conf
关键是logstash配置简单容易上手,对同版本的elasticsearch支持比较好。