ELK-logstash 收集TCP日志

[root@linux-node4 ~]# cd /etc/logstash/conf.d/
[root@linux-node4 conf.d]# ll
total 8
-rw-r–r-- 1 root root 303 Aug 19 14:43 systemlog.conf
-rw-r–r-- 1 root root 381 Aug 20 15:33 tomcat.conf
[root@linux-node4 conf.d]# mv * /opt —把前面的配置不要了
[root@linux-node4 conf.d]# cd /opt
[root@linux-node4 conf.d]# vim tcp.conf

input {
  tcp {
   port => "900"
   type => "tcplog"
  }
}


output {
  stdout {
    codec => "rubydebug"
  }
}

[root@linux-node4 conf.d]# /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/tcp.conf –t

[root@linux-node4 conf.d]# /usr/share/logstash/bin/logstash -f /etc/logstash/cf.d/tcp.conf --监听这个900端口
[root@linux-node3 ~]# yum install nc –y
[root@linux-node3 ~]# echo “test” | nc 10.0.0.18 900

正式监听端口
[root@linux-node4 conf.d]# vim tcp.conf

input {
  tcp {
   port => "9900"
   type => "tcplog"
  }
}


output {
  elasticsearch {
    hosts => ["10.0.0.17:9200"]
    index => "tcplog-18-%{+YYYY.MM.dd}"
  }
}

[root@linux-node4 conf.d]# systemctl restart logstash