logstash7.1.1 安装

最新推荐文章于 2024-05-19 23:31:10 发布

zhangkanglei

最新推荐文章于 2024-05-19 23:31:10 发布

阅读量319

点赞数 8

文章标签：运维 centos

本文链接：https://blog.csdn.net/zhangkanglei/article/details/136026205

版权

加压安装,授权

cd /data/software/elk
tar -xzvf /data/software/elk/logstash-7.1.1.tar.gz
chown -R esuser:esuser logstash-7.1.1

修改logstash配置文件，在logstash-7.1.1目录下创建pipeline。将logstash-sample.conf文件拷贝到pipeline该文件夹下，修改logstash-sample.conf中output中elasticsearch的地址。

cd /data/software/elk/logstash-7.1.1/pipeline
mv /data/software/elk/logstash-7.1.1/config/logstash-sample.conf .
vim logstash-sample.conf
## 接下来是是内容
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.


input {
  beats {
    port => 5044

  }


}


filter {
json{
		source => "message"
		skip_on_invalid_json => "true"
	}

        #grok {
            # Do multiline matching with (?m) as the above mutliline filter may add newlines to the log messages.
           # match => [ "message", "(?m)^%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{LOGLEVEL:LEVEL}%{SPACE}\[%{DATA:javaClass}\]%{SPACE}-%{GREEDYDATA:msg}" ]
            # 覆盖原有的message
            #overwrite=> [ "message" ]
        #}
grok { 
match => ["message", "%{TIMESTAMP_ISO8601:logdate}"]
}
date { 
match => ["logdate", "yyyy-MM-dd HH:mm:ss.SSS"]
target => "@timestamp"
}
mutate {
      remove_field => ["@version","tags","ecs","host","agent","input","log.offset","log.file.path","fields.service"]
    }



}



output {

	if[fields][service]=="backstage" {
	  elasticsearch {
	  hosts => ["192.168.1.71:9200"]	
	  index => "backstage-%{+YYYY.MM.dd}"
	  user => "elastic"
	  password => "123456"
	  }
                }
	else if[fields][service]=="province" {
	  elasticsearch {
	  hosts => ["192.168.1.71:9200"]	
	  index => "province-%{+YYYY.MM.dd}"
	  user => "elastic"
	  password => "123456"
	  }
                }
	else if[fields][service]=="discipline-inspection" {
	  elasticsearch {
	  hosts => ["192.168.1.71:9200"]	
	  index => "discipline-inspection-%{+YYYY.MM.dd}"
	  user => "elastic"
	  password => "123456"
	  }
                }
	else if[fields][service]=="zhongyuan" {
	  elasticsearch {
	  hosts => ["192.168.1.71:9200"]	
	  index => "zhongyuan-%{+YYYY.MM.dd}"
	  user => "elastic"
	  password => "123456"
	  }
                }
	else if[fields][service]=="gateway-energy" {
	  elasticsearch {
	  hosts => ["192.168.1.71:9200"]	
	  index => "gateway-energy-%{+YYYY.MM.dd}"
	  user => "elastic"
	  password => "123456"
	  }
                }
	else if[fields][service]=="gateway-province" {
	  elasticsearch {
	  hosts => ["192.168.1.71:9200"]	
	  index => "gateway-province-%{+YYYY.MM.dd}"
	  user => "elastic"
	  password => "123456"
	  }
                }											

}