flume 1.6.0提供的 elasticsearchSink 和 elastic-search2.3.5不兼容,
在网上找了几个版本后都无法使用。
所以只能自己改源码了。。。。。。
1,将 flume /lib 下的 guava 删掉
2,将 es /lib下的jar 全部复制到 flume/lib 下
3,将flume/lib 下原来的elasticsearchSink 删掉
4,使用我提供的 jar放入 flume/lib
链接:http://pan.baidu.com/s/1mhTAcNe 密码:3v5r
配置如下
agent.sources = r1
agent.channels = c1
agent.sinks =es
# Describe/configure the source
agent.sources.r1.type = avro
agent.sources.r1.bind = 192.168.227.103
agent.sources.r1.port = 44444
# a0.sources.r1.command = tail -f /usr/local/flume-z0/testlog/test.log
# Describe the sink
agent.sinks.es.type = org.apache.flume.sink.elasticsearch.ElasticSearchSink
#a2.sinks.es.client=rest
agent.sinks.es.batchSize=100
agent.sinks.es.hostNames=192.168.227.102:9300,192.168.227.103:9300,192.168.227.104:9300
agent.sinks.es.indexName=log
agent.sinks.es.indexType=log-producer
#agent.sinks.es.batchSize = 100
agent.sinks.es.clusterName=lxn-es
#agent.sinks.es.serializer=org.apache.flume.sink.elasticsearch.ElasticSearchDynamicSerializer
agent.sinks.es.serializer=org.apache.flume.sink.elasticsearch.ElasticSearchLogStashEventSerializer
agent.sinks.es.indexNameBuilder = org.apache.flume.sink.elasticsearch.SimpleIndexNameBuilder
# Use a channel which buffers events in memory
agent.channels.c1.type = memory
agent.channels.c1.capacity = 1000
agent.channels.c1.transactionCapacity = 100
# Bind the source and sink to the channel
agent.sources.r1.channels = c1
agent.sinks.es.channel = c1