logStash安装

logStash官网:

　　　　https://www.elastic.co/guide/en/logstash/current/index.html

首先现在logstash，上传到服务器

 　　

logstash是用JRuby语言开发的，所以要安装JDK

 

解压logstash到指定目录

　　tar -zxvf logstash-2.3.1.tar.gz -C /bigdata/

 

bin/logstash -e 'input { stdin {} } output { stdout{} }'

bin/logstash -e 'input { stdin {} } output { stdout{codec => rubydebug} }'

bin/logstash -e 'input { stdin {} } output { elasticsearch {hosts => ["172.16.0.14:9200"]} stdout{} }'

bin/logstash -e 'input { stdin {} } output { elasticsearch {hosts => ["172.16.0.15:9200", "172.16.0.16:9200"]} stdout{} }'

 

bin/logstash -e 'input { stdin {} } output { kafka { topic_id => "itcast" bootstrap_servers => "172.16.0.11:9092,172.16.0.12:9092,172.16.0.13:9092"} stdout{codec => rubydebug} }'

 

--------------------------------------------------------------------

以配置的形式

vi logstash.conf

 

input {

file {

type => "gamelog"

path => "/log/*/*.log"

discover_interval => 10

start_position => "beginning"

}

}

 

output {

elasticsearch {

index => "gamelog-%{+YYYY.MM.dd}"

hosts => ["172.16.0.14:9200", "172.16.0.15:9200", "172.16.0.16:9200"]

}

}

 

#启动logstack

bin/logstash -f logstash.conf

bin/logstash -e '

input { stdin {} }

filter {

grok {

match => { "message" => "%{IP:client} %{WORD:method} %{URIPATHPARAM:request} %{NUMBER:bytes} %{NUMBER:duration}" }

}

}

output { stdout{codec => rubydebug}

}'