ganglia离线安装_ELK学习笔记之logstash安装logstash-filter-multiline(在线离线安装)

0x00 概述

ELK-logstash在搬运日志的时候会出现多行日志，普通的搬运会造成保存到ES中单条单条，很丑，而且不方便读取，logstash-filter-multiline可以解决该问题

普通日志如下：

记录到es会的记录则是：

我们希望的结果肯定是这样的

0x01 原生安装

# /usr/share/logstash/bin/logstash-plugin install logstash-filter-multiline

Validating logstash-filter-multiline

Installing logstash-filter-multiline

WARNING: can not set Session#timeout=(0) no session context

0x02 改镜像源安装

给 Ruby 加上国内的镜像站：https://gems.ruby-china.com/，替代https://rubygems.org。

注意原https://gems.ruby-china.org/目前已经可用，需要使用https://gems.ruby-china.com/

1. 安装Gem并更新

# yum install -y gem

# gem -v

2.0.14.1

# gem update --system

# gem -v

2.6.13

2. 检查并修改镜像源

# gem sources -l

*** CURRENT SOURCES ***

https://rubygems.org/

# gem sources --add https://gems.ruby-china.com/ --remove https://rubygems.org/

https://gems.ruby-china.com/ added to sources

https://rubygems.org/ removed from sources

# cat ~/.gemrc

---

:backtrace: false

:bulk_threshold: 1000

:sources:

- https://gems.ruby-china.com/

:update_sources: true

:verbose: true

3. 安装 bundle 并更改镜像源

# gem install bundler

# bundle config mirror.https://rubygems.org https://gems.ruby-china.com

4. 修改 logstash的 gem 镜像源

# vim /usr/share/logstash/Gemfile

# This is a Logstash generated Gemfile.

#