logstash 安装与启动

官网下载

https://www.elastic.co/cn/products/logstash

在logstash/config目录建立配置文件logstash.config内容以下

#配置收集规则
input {
  stdin {}
}


#配置过滤规则
filter {
    grok {
        match => {
            "message" => "%{WORD} %{IP:client} %{WORD}"
        }
    }
}
#配置输出规则
output {
     elasticsearch {
                hosts => ["10.116.69.4:9200" ]
                action => "index"
                codec => rubydebug
                index => "%{type}-%{+YYYY.MM.dd}"
                template_name => "%{type}"
        }
}

启动

nohup ./bin/logstash -f logstash.config &>nohup.log&