logstash安装

https://www.elastic.co/guide/en/logstash/current/index.html
首先现在logstash，上传到服务器


logstash是用JRuby语言开发的，所以要安装JDK


tar -zxvf logstash-2.3.1.tar.gz -C /bigdata/




bin/logstash -e 'input { stdin {} } output { stdout{} }'
bin/logstash -e 'input { stdin {} } output { stdout{codec => rubydebug} }'
bin/logstash -e 'input { stdin {} } output { elasticsearch {hosts => ["172.16.0.14:9200"]} stdout{} }'
bin/logstash -e 'input { stdin {} } output { elasticsearch {hosts => ["172.16.0.15:9200", "172.16.0.16:9200"]} stdout{} }'


bin/logstash -e 'input { stdin {} } output { kafka { topic_id => "itcast" bootstrap_servers => "172.16.0.11:9092,172.16.0.12:9092,172.16.0.13:9092"} stdout{codec => rubydebug} }'


--------------------------------------------------------------------
以配置的形式
vi logstash.conf


input {
file {
type => "gamelog"
path => "/log/*/*.log"
discover_interval => 10
start_position => "beginning" 
}
}


output {
    elasticsearch {
index => "gamelog-%{+YYYY.MM.dd}"
        hosts => ["172.16.0.14:9200", "172.16.0.15:9200", "172.16.0.16:9200"]
    }
}


#启动logstack
bin/logstash -f logstash.conf






bin/logstash -e '
input { stdin {} }
filter {
  grok {
    match => { "message" => "%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" }
  }
} 
output { stdout{codec => rubydebug} 
}'