在实际应用中,Logstash进程会被氛围两个不同的角色。 运行在应用服务器上的尽量减轻运行压力,只做读取和转发,这个角色叫做shipper 运行在独立的服务器上完成数据解析处理,负责写入到Elasticsearch的角色,叫做Indexer 5.1.1 读取redis 数据: zjtest7-frontend:/usr/local/logstash-2.3.4/config# ../bin/logstash -f redis.comf Settings: Default pipeline workers: 1 Pipeline main started { "message" => "Hello world", "tags" => [ [0] "_jsonparsefailure" ], "@version" => "1", "@timestamp" => "2016-08-19T06:26:12.854Z" } zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat redis.comf input { redis { data_type =>"pattern_channel" key =>"logstash-*" host=>"192.168.32.67" port=>6379 password => "1234567" } } output { stdout { codec=>rubydebug{} } } 采用list类型扩展Logstash: 127.0.0.1:6379> PUBLISH logstash-list "Hello xxxxxx" (integer) 2 127.0.0.1:6379> PUBLISH logstash-list "Hello yyyyy" zjtest7-frontend:/usr/local/logstash-2.3.4/config# ../bin/logstash -f redis.comf Settings: Default pipeline workers: 1 Pipeline main started { "message" => "Hello xxxxxx", "tags" => [ [0] "_jsonparsefailure" ], "@version" => "1", "@timestamp" => "2016-08-19T07:46:27.031Z" } { "message" => "Hello yyyyy", "tags" => [ [0] "_jsonparsefailure" ], "@version" => "1", "@timestamp" => "2016-08-19T07:46:37.365Z" zjtest7-frontend:/usr/local/logstash-2.3.4/config# ../bin/logstash -f redis.comf Settings: Default pipeline workers: 1 Pipeline main started { "message" => "Hello xxxxxx", "tags" => [ [0] "_jsonparsefailure" ], "@version" => "1", "@timestamp" => "2016-08-19T07:46:26.964Z" } { "message" => "Hello yyyyy", "tags" => [ [0] "_jsonparsefailure" ], "@version" => "1", "@timestamp" => "2016-08-19T07:46:37.362Z" } zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat redis.comf input { redis { data_type =>"pattern_channel" key =>"logstash-list" host=>"192.168.32.67" port=>6379 password => "1234567" } } output { stdout { codec=>rubydebug{} } } 两个终端同时启动logstash -f redis.conf 进程,结果会是两个终端都输出消息。 这个时候,就需要用list 类型,在这种类型中,数据输入到Redis 服务器上暂存,Logstash 则连上Redis 服务器取走(BLPOP命令,所以只要logstash不堵塞,redis 服务器上也不会 有数据堆积占用空间)数据。 1.配置示例: zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat redis.comf input { redis { data_type =>"list" key =>"logstash-list" host=>"192.168.32.67" port=>6379 password => "1234567" } } output { stdout { codec=>rubydebug{} } } 这时候可以看到, 只有一个终端输出了结果 连续RPUSH几次, 可以看到两个终端近乎各自输出一半条目。 3.批量推送: RPUSH 支持batch 方式,修改Logstash 配置中的batch_count值, 5.1.3 输出到Redis: 1.配置示例 zjtest7-frontend:/usr/local/logstash-2.3.4/config# cat inputredis.conf input {stdin {} } output { redis { data_type =>"channel" key=>"logstash-chan-%{+yyyy.MM.dd}" host=>"192.168.32.67" port=>6379 password => "1234567" } } 127.0.0.1:6379> SUBSCRIBE logstash-chan-2016.08.19 Reading messages... (press Ctrl-C to quit) 1) "subscribe" 2) "logstash-chan-2016.08.19" 3) (integer) 1 1) "message" 2) "logstash-chan-2016.08.19" 3) "{"message":"","@version":"1","@timestamp":"2016-08-19T08:27:07.190Z","host":"0.0.0.0"}" 1) "message" 2) "logstash-chan-2016.08.19" 3) "{"message":"","@version":"1","@timestamp":"2016-08-19T08:27:07.736Z","host":"0.0.0.0"}" 1) "message" 2) "logstash-chan-2016.08.19" 3) "{"message":"","@version":"1","@timestamp":"2016-08-19T08:27:07.772Z","host":"0.0.0.0"}" 1) "message" 2) "logstash-chan-2016.08.19" 3) "{"message":"","@version":"1","@timestamp":"2016-08-19T08:27:07.808Z","host":"0.0.0.0"}" 1) "message" 2) "logstash-chan-2016.08.19" 3) "{"message":"","@version":"1","@timestamp":"2016-08-19T08:27:07.844Z","host":"0.0.0.0"}" 1) "message" 2) "logstash-chan-2016.08.19" 3) "{"message":"","@version":"1","@timestamp":"2016-08-19T08:27:07.880Z","host":"0.0.0.0"}" 1) "message" 2) "logstash-chan-2016.08.19" 3) "{"message":"","@version":"1","@timestamp":"2016-08-19T08:27:07.916Z","host":"0.0.0.0"}" 1) "message" 2) "logstash-chan-2016.08.19" 3) "{"message":"hello world","@version":"1","@timestamp":"2016-08-19T08:27:10.486Z","host":"0.0.0.0"}" 1) "message" 2) "logstash-chan-2016.08.19" 3) "{"message":"what'sup scab","@version":"1","@timestamp":"2016-08-19T08:27:37.919Z","host":"0.0.0.0"}"