ELK 日志分析系统（三）

1.安装logstash

Logstash默认的对外服务的端口是9292。

2.在usr目录下建立logstash安装目录

cd /usr
mkdir logstash

2.3.2.将logstash-5.4.2.tar拷贝到java目录下

cp /mnt/hgfs/linux/logstash-5.4.2.tar /usr/logstash/

3.解压logstash到当前目录

tar -zxvf logstash-5.4.2.tar
得到文件夹 logstash-5.4.2

4.启动

logstash用root用户启动
输入命令：bin/logstash -e “”，然后命令行会变成等待输入状态，随便输入如：Hello World！能够得到如下图则安装成功：
bin/logstash -e “”

5.用配置文件启动

结合elasticsearch

# mkdir -p /usr/local/logstash/etc  
# vim /usr/local/logstash/etc/hello_search.conf  
# vim /usr/local/logstash/etc/logstash_agent.conf

5.1.输出到控制台

input { stdin { } }
output {
 elasticsearch { hosts => "10.211.55.3:9200" }
 stdout { codec => rubydebug }
}

• 5.2.输出到文件

input {
  file {
    type => "http.access"
    path => ["/var/log/httpd/access_log"]
  }

  file {
    type => "http.error"
    path => ["/var/log/httpd/error_log"]
  }

  file {
    type => "messages"
    path => ["/var/log/messages"]
  }
}

output {
  elasticsearch {
    hosts => ["10.211.55.3:9200"]
    index => "test"
  }
}

启动方式

# /usr/logstash/logstash-5.4.2/bin/logstash -f /usr/logstash/etc/config.conf

下图是在控制台输入到展示