SS00015.elasticsearch——|Hadoop&ElasticSearch集中式日志分析系统.v15|——|Elasticsearch.v15|

一、Logstash读取Kafka

### --- Logstash配置文件

~~~     官网地址：https://www.elastic.co/guide/en/logstash/7.3/plugins-inputs-kafka.html

### --- 上传IP地址库

~~~     # 上传IP地址库到Datas目录下
[root@hadoop02 ~]# ll /opt/yanqi/servers/es/datas/GeoLite2-City.mmdb 
/opt/yanqi/servers/es/datas/GeoLite2-City.mmdb

二、Logstash读取kafka配置

### --- Logstash配置文件编写

~~~     # 编写logstash读取kafka数据的配置文件
[root@hadoop02 ~]# vim /opt/yanqi/servers/es/Logstash/config/logstash_kafka_es.conf
~~~     # 写入如下参数
input {
    kafka {
        bootstrap_servers => "hadoop01:9092,hadoop02:9092,hadoop03:9092"
        topics => ["nginx_access_log"]
        codec => "json"
    }
}

filter {
  if [app] == "www" {
    if [type] == "nginx-access" {
      json {
          source => "message"
          remove_field => ["message"]
      }
      geoip {
          source => "remote_addr"
          target => "geoip"
          database &