elk-4-logstash6.5安装

解压[vip]

[root@gateway opt]# tar zxf logstash-6.5.1.tar.gz 

[root@gateway opt]# mv logstash-6.5.1 logstash
[root@gateway config]# pwd
/opt/logstash/config
[root@gateway config]# ll
总用量 32
-rw-r--r-- 1 root root 1846 11月 16 11:06 jvm.options
-rw-r--r-- 1 root root 4568 11月 16 11:06 log4j2.properties
-rw-r--r-- 1 root root  342 11月 16 11:06 logstash-sample.conf
-rw-r--r-- 1 root root 8162 11月 16 11:06 logstash.yml
-rw-r--r-- 1 root root 3244 11月 16 11:06 pipelines.yml
-rw-r--r-- 1 root root 1696 11月 16 11:06 startup.options

测试

进入如下目录

[root@operation bin]# pwd
/opt/logstash/bin

输入./logstash -e ""和hello 看到如下信息说明安装成功

[root@operation bin]# ./logstash -e ""
Sending Logstash logs to /opt/logstash/logs which is now configured via log4j2.properties
[2018-12-06T10:15:57,820][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.queue", :path=>"/opt/logstash/data/queue"}
[2018-12-06T10:15:57,828][INFO ][logstash.setting.writabledirectory] Creating directory {:setting=>"path.dead_letter_queue", :path=>"/opt/logstash/data/dead_letter_queue"}
[2018-12-06T10:15:58,156][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-12-06T10:15:58,165][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.5.1"}
[2018-12-06T10:15:58,188][INFO ][logstash.agent ] No persistent UUID file found. Generating new UUID {:uuid=>"0231f74b-7caa-4527-849e-e43331985d50", :path=>"/opt/logstash/data/uuid"}
[2018-12-06T10:16:00,855][INFO ][logstash.pipeline ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>6, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2018-12-06T10:16:00,967][INFO ][logstash.pipeline ] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x29b3a88e run>"}
The stdin plugin is now waiting for input:
[2018-12-06T10:16:01,003][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2018-12-06T10:16:01,185][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
hello
{
"@timestamp" => 2018-12-06T02:17:04.306Z,
"host" => "operation.gr-data.uat",
"type" => "stdin",
"@version" => "1",
"message" => "hello"
}

创建一个conf.d目录存放配置文件

[root@gateway logstash]# mkdir conf.d
[root@gateway logstash]# pwd
/opt/logstash
[root@gateway logstash]# ll
总用量 844
drwxr-xr-x 2 root root 4096 12月 5 19:04 bin
drwxr-xr-x 2 root root 6 12月 5 19:09 conf.d

比如使用拉取nginx的日志

[root@localhost conf.d]# cat logstash_cli.conf 
input {
file {
path => [ "/var/log/nginx/access.log" ] 
type => "nginx_log" 
start_position => "beginning" 
}

}


output {
stdout {
codec => rubydebug
}
}

检查配置文件是否正确

[root@localhost conf.d]# /opt/logstash-6.5.1/bin/logstash -t -f ./logstash_cli.conf 
Sending Logstash logs to /opt/logstash-6.5.1/logs which is now configured via log4j2.properties
[2018-12-06T22:19:09,895][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
Configuration OK
[2018-12-06T22:19:12,068][INFO ][logstash.runner ] Using config.test_and_exit mode. Config Validation Result: OK. Exiting Logstash

写入到es

[root@localhost conf.d]# cat logstash_cli.conf 
input {
file {
path => [ "/var/log/nginx/access.log" ] 
type => "nginx_log" 
start_position => "beginning" 
}

}


output {
elasticsearch {
hosts => "192.168.1.210"
index => "nginx-%{+YYYY.MM.dd}"
}
}

检查配置

[root@localhost conf.d]# /opt/logstash-6.5.1/bin/logstash -t -f ./logstash_cli.conf 
Sending Logstash logs to /opt/logstash-6.5.1/logs which is now configured via log4j2.properties
[2018-12-06T22:26:49,540][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
Configuration OK
[2018-12-06T22:26:50,997][INFO ][logstash.runner ] Using config.test_and_exit mode. Config Validation Result: OK. Exiting Logstash

启动

[root@localhost conf.d]# nohup /opt/logstash-6.5.1/bin/logstash -f ./logstash_cli.conf & 
[1] 17621
[root@localhost conf.d]# nohup: 忽略输入并把输出追加到"nohup.out"

[root@localhost conf.d]# ps aux|grep logstash
root 17621 341 8.3 3688884 648416 pts/1 Sl 22:28 0:37 /bin/java -Xms1g -Xmx1g -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true -Dfile.encoding=UTF-8 -Djruby.compile.invokedynamic=true -Djruby.jit.threshold=0 -XX:+HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -cp /opt/logstash-6.5.1/logstash-core/lib/jars/animal-sniffer-annotations-1.14.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/commons-codec-1.11.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/commons-compiler-3.0.8.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/error_prone_annotations-2.0.18.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/google-java-format-1.1.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/gradle-license-report-0.7.1.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/guava-22.0.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/j2objc-annotations-1.1.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/jackson-annotations-2.9.5.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/jackson-core-2.9.5.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/jackson-databind-2.9.5.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/jackson-dataformat-cbor-2.9.5.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/janino-3.0.8.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/jruby-complete-9.1.13.0.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/jsr305-1.3.9.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/log4j-api-2.9.1.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/log4j-core-2.9.1.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/log4j-slf4j-impl-2.9.1.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/logstash-core.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.core.commands-3.6.0.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.core.contenttype-3.4.100.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.core.expressions-3.4.300.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.core.filesystem-1.3.100.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.core.jobs-3.5.100.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.core.resources-3.7.100.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.core.runtime-3.7.0.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.equinox.app-1.3.100.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.equinox.common-3.6.0.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.equinox.preferences-3.4.1.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.equinox.registry-3.5.101.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.jdt.core-3.10.0.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.osgi-3.7.1.jar:/opt/logstash-6.5.1/logstash-core/lib/jars/org.eclipse.text-3.5.101.jar:/opt/logstash-6.5.1logstash-core/lib/jars/slf4j-api-1.7.25.jar org.logstash.Logstash -f ./logstash_cli.conf
root 17651 0.0 0.0 112664 972 pts/1 R+ 22:28 0:00 grep --color=auto logstash

[/vip]