linux 启动logstash_logstash 运行

logstash linux下启动如下

(守护进程)

./bin/logstash agent -f conf/paycenter.conf &

logstash配置

测试服务器的写法：

业务日志文件格式如果是按天分隔:

gwp.eyimi.com_80_access_2017-07-18.log

gwp.eyimi.com_80_access_2017-07-19.log

gwp.eyimi.com_80_access_2017-07-19.log

那么在input里面使用日期格式

/data/other/nginxlogs/gwp.eyimi.com_80_access%{+YYYY.MM.dd}.log

如果是只有一个文件格式，直接使用文件的绝对路径即可！

input {

file {

path => "/data/other/nginx_logs/gwp.eyimi.com_80_access_%{+YYYY.MM.dd}.log"

codec => "json"

type => "zuolinyoujia"

}

//可以写多个文件，不过多个文件最终的type必须统一为一个！！！

// file {

// path => "/data/other/nginx_logs/nginx_error.log"

// codec => "json"

// type => "zuolinyoujia"

// }

}

output {

redis {

batch_count => 10

data_type => "list"

host => "10.0.9.43"

port => 4501

key => "%{type}"

password => "chngalaxy2017!!!" #如果有安全认证，此项为密码

codec => "json"

threads => 2

}

}

}

正式服务器的写法

(正式服务器的机器资源在申请，先内网测试走通一下看看)

input {

file {

path => "/data/other/nginx_logs/gwp.eyimi.com_80_access.log"

codec => "json"

type => "zuolinyoujia"

}

file {

path => "/data/other/nginx_logs/nginx_error.log"

codec => "json"

type => "zuolinyoujia"

}

}

output {

redis {

batch_count => 10

data_type => "list"

host => "192.168.0.75"

port => 4501

key => "%{type}"

password => "chngalaxylog2017good!!!" #如果有安全认证，此项为密码

codec => "json"

threads => 2

}

}

}