虚拟机 CentOS 6.5 安装logstash 6.X

本文参照https://www.elastic.co/guide/en/logstash/current/installing-logstash.html 官方文档编写

Logstash 6 需要Java 8.不支持Java 9。所以首先确认本机的java版本

[root@elk /]# java -version
java version "1.8.0_161"
Java(TM) SE Runtime Environment (build 1.8.0_161-b12)
Java HotSpot(TM) 64-Bit Server VM (build 25.161-b12, mixed mode)

本文档使用yum方法安装，首先下载并安装公共签名密钥

[root@elk /]# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

新建一个repo文件，名字随意

[root@elk /]# vim /etc/yum.repos.d/logstash.repo

添加以下内容：

[logstash-6.x]
name=Elastic repository for 6.x packages
baseurl=https://artifacts.elastic.co/packages/6.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

然后可以开始安装:

[root@elk /]# sudo yum install logstash

Dependencies Resolved

=================================================================================================================================================
 Package                          Arch                           Version                              Repository                            Size
=================================================================================================================================================
Installing:
 logstash                         noarch                         1:6.2.2-1                            logstash-6.x                         134 M

Transaction Summary
=================================================================================================================================================
Install       1 Package(s)

Total download size: 134 M
Installed size: 224 M
Is this ok [y/N]: y
Downloading Packages:
logstash-6.2.2.rpm                                                                                                        | 134 MB     01:04     
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : 1:logstash-6.2.2-1.noarch                                                                                                     1/1 
Using provided startup.options file: /etc/logstash/startup.options
Successfully created system startup script for Logstash
  Verifying  : 1:logstash-6.2.2-1.noarch                                                                                                     1/1 

Installed:
  logstash.noarch 1:6.2.2-1                                                                                                                      

Complete!

安装完成后，查看logstash 安装在哪里

[root@elk /]# whereis logstash
logstash: /etc/logstash /usr/share/logstash

验证安装是否成功

进入logstash目录，输入测试命令

[root@elk logstash]# pwd
/usr/share/logstash
[root@elk logstash]# bin/logstash -e 'input { stdin { } } output { stdout {} }'

WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[INFO ] 2018-02-28 16:47:54.928 [main] scaffold - Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
[INFO ] 2018-02-28 16:47:54.935 [main] scaffold - Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"}
[WARN ] 2018-02-28 16:47:55.369 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2018-02-28 16:47:55.516 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"6.2.2"}
[INFO ] 2018-02-28 16:47:55.653 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[INFO ] 2018-02-28 16:47:55.974 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] pipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
The stdin plugin is now waiting for input:
[INFO ] 2018-02-28 16:47:56.077 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] pipeline - Pipeline started succesfully {:pipeline_id=>"main", :thread=>"#<Thread:0x41a04b21@/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:246 sleep>"}
[INFO ] 2018-02-28 16:47:56.104 [Ruby-0-Thread-1: /usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:22] agent - Pipelines running {:count=>1, :pipelines=>["main"]}

输入任何字符，logstash打印相应字符

aa
2018-02-28T08:48:11.836Z 0.0.0.0 aa
bb
2018-02-28T08:48:12.783Z 0.0.0.0 bb
cc
2018-02-28T08:48:13.488Z 0.0.0.0 cc

logstash 安装成功

更多：

可以控制输出，使信息更加详细

[root@elk logstash]# bin/logstash -e 'input { stdin { } } output { stdout {codec => rubydebug }}'