Logstash读取文本信息并写入到ES

Logstash读取文本信息并写入到ES

前提是ELK安装没问题

进入到logstash安装目录下的bin目录（我的logstash安装目录：/usr/local/）

[root@es1 bin]# cd /usr/local/logstash-5.5.2/bin

[root@es1 bin]# ll

total 100

-rwxr-xr-x 1 root root   377 Aug 14  2017 cpdump

-rw-r--r-- 1 root root 15821 Dec 27 00:58 hs_err_pid1888.log

-rw-r--r-- 1 root root 15821 Dec 27 01:01 hs_err_pid1929.log

-rw-r--r-- 1 root root 15821 Dec 27 01:05 hs_err_pid2026.log

-rwxr-xr-x 1 root root   155 Aug 14  2017 ingest-convert.sh

-rwxr-xr-x 1 root root  1949 Aug 14  2017 logstash

-rw-r--r-- 1 root root   677 Aug 14  2017 logstash.bat

-rw-r--r-- 1 root root   756 Dec 27 16:30 logstash.conf

-rwxr-xr-x 1 root root  5400 Aug 14  2017 logstash.lib.sh

-rwxr-xr-x 1 root root   448 Aug 14  2017 logstash-plugin

-rw-r--r-- 1 root root   251 Aug 14  2017 logstash-plugin.bat

-rw-r--r-- 1 root root  1138 Dec 27 17:21 mysqltoes.conf

-rwxr-xr-x 1 root root   840 Aug 14  2017 ruby

-rw-r--r-- 1 root root  2795 Aug 14  2017 setup.bat

-rwxr-xr-x 1 root root  3530 Aug 14  2017 system-install

 

修改logstash.conf文件

[root@es1 log]# vim /usr/local/logstash-5.5.2/bin/logstash.conf

#

input{

  file{

      path=>["/var/log/test.log"]

      type=>"logstash_log"

      start_position =>"beginning"

  }

}

 

output{

    elasticsearch{

        hosts=>["192.168.100.101:9200","192.168.100.102:9200","192.168.100.103:9200"]

        index=>"log-%{+YYYY.MM.dd.HH.mm.ss}"

        }

}

 

运行

./logstash -f logstash.conf

 

转载于:https://www.cnblogs.com/ylht/p/10195278.html