logstash

最新推荐文章于 2021-09-07 11:05:49 发布

原创最新推荐文章于 2021-09-07 11:05:49 发布 · 322 阅读

1 ·

CC 4.0 BY-SA版权

docker 专栏收录该内容

10 篇文章

订阅专栏

第一种：

通过官网logstash包下载安装 https://artifacts.elastic.co/downloads/logstash/logstash-7.10.1-linux-aarch64.tar.gz

解压在mnt目录下

修改配置文件.conf

cd /mnt/logstash-7.10.1

bin/logstash -f config/logstash-sample.conf -t 检测配置文件

bin/logstash -f config/logstash-sample.conf >/dev/null 2>log & 后台启动

日志在 /mnt/logstash-7.10.1/logs

input { stdin { } }
output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}

bin/logstash -f logstash-simple.conf

第二种： docker 安装

https://www.elastic.co/cn/downloads/logstash
https://artifacts.elastic.co/downloads/logstash/logstash-7.10.1-linux-aarch64.tar.gz
yum: command not found

使用docker 安装Logstash，来收集文件/var/log/messages

https://blog.youkuaiyun.com/shykevin/article/details/108251996
5044 9600

docker pull wep4you/logstash:7.9.2

docker run -d --name=logstash wep4you/logstash:7.9.2

等待30秒，查看日志
docker logs -f logstash

mkdir -p /mnt/docker/elk7/logstash/config/conf.d

docker cp logstash:/usr/share/logstash/config /mnt/docker/elk7/logstash/
docker cp logstash:/usr/share/logstash/data /mnt/docker/elk7/logstash/
docker cp logstash:/usr/share/logstash/pipeline /mnt/docker/elk7/logstash/
chmod 777 -R /mnt/docker/elk7/logstash

vim /mnt/docker/elk7/logstash/config/logstash.yml
http.host: "0.0.0.0"
xpack.monitoring.elasticsearch.hosts: [ "http://139.9.53.103:9200" ]
path.config: /usr/share/logstash/config/conf.d/*.conf
path.logs: /usr/share/logstash/logs

vim /mnt/docker/elk7/logstash/config/conf.d/syslog.conf
input {
file {
#标签
type => "systemlog-localhost"
#采集点
path => "/var/log/messages"
#开始收集点
start_position => "beginning"
#扫描间隔时间，默认是1s，建议5s
stat_interval => "5"
}
}

output {
elasticsearch {
hosts => ["您的ip:9200"]
index => "logstash-system-localhost-%{+YYYY.MM.dd}"
}
}

docker rm -f logstash 强制删除一个运行中的日容器

chmod 644 /var/log/messages

docker run -d -p 5044:5044 --name=logstash --restart=always -v /mnt/docker/elk7/logstash:/usr/share/logstash -v /var/log/messages:/var/log/messages wep4you/logstash:7.9.2

docker run -d --restart=always --log-driver json-file --log-opt max-size=100m --log-opt max-file=2 -p 5044:5044 --name xinyar-logstash -v /data/elk/logstash/logstash.yml:/usr/share/logstash/config/logstash.yml -v /data/elk/logstash/conf.d/:/usr/share/logstash/conf.d/ logstash:7.4.1

docker exec -it logstash /bin/bash