logstash简单配置

# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

###logstash输入：从/var/log/messages输入，类型为system，起始位
input {
    file {
      path => "D:/datas/test.log" #指定数据来源文件
    }
}

filter{
        mutate{
                add_field => { "@message" => "%{message}"} 
        }
        json {
                source => "@message"
                remove_field => [ "@message", "message","@version","event","log"]
        }
}

###logstash输出：输出给elasticsearch（以IP地址指定位置）
output {
    elasticsearch {
        hosts => ["127.0.0.1:9200"]
        index => "testlogstash-%{+YYY.MM.dd}" #字母一定小写，我的大写报错了
    }
    # 日志输出:
    stdout {
        codec => json_lines
    }

}

======================================

test.log文件测试内容，注：可以不是json格式

{"name":"xiaofeifei","age":19}
{"name":"小强强","sex":"女"}

=====================