logstash从不同服务器收集日志到一台总服务

1，wget https://artifacts.elastic.co/downloads/logstash/logstash-6.4.2.tar.gz
2，tar -zxvf logstash-6.4.2.tar.gz
3，cd /opt/tmp/logstash-6.4.2
4,在终端中，像下面这样运行命令来启动 Logstash 进程：

# bin/logstash -e 'input{stdin{}}output{stdout{codec=>rubydebug}}'

然后你会发现终端在等待你的输入。没问题，敲入 Hello World，回车，然后看看会返回什么结果！
安装成功！
5，配置服务端conf

input {
  tcp {
	mode => "server"
	port => 9600
	ssl_enable => false
  }
}
filter {
    json {
        source => "message"
    }
}
output {
    file {
        path => "/opt/lampp/crm_ceshi/logECO/%{+YYYY-MM-dd}/%{servip}-%{filename}"
        codec => line { format => "%{message}"}
    }
}

启动bin/logstash -f config/logstash-server.conf

6,另一台需要收集的客户端配置

input{
    file {
        path => ["/opt/lampp/crm_ceshi/logECO/2018-10-30/agreeRefundToElemeV2.txt"]
        type => "ecolog"
        start_position => "beginning"
		sincedb_path => "/opt/tmp/logstash-6.4.2/data/plugins/inputs/file/.sincedb_3f3dc7129f441b61d81b1acadb65ed4e"
    }
}
filter {
    if [type] =~ /^ecolog/ {
        ruby {
            code => "file_name = event.get('path').split('/')[-1]
					 event.set('file_name',file_name)
					 event.set('servip','客户端IP')"
        }
        mutate {
            rename => {"file_name" => "filename"}
        }
    }
}
output {
	tcp {
        host  => "服务端ip"
        port  => 9600
        codec => json_lines
    }
}

启动bin/logstash -f config/logstash-server.conf
好了，远程收集日志按ip分已经完成，修改日志文件或增加，服务端改变