ELK部署

一、logstash
版本：2.4.0
要求：Java 7 +
配置：系统java 1.6，修改bin/logstash.lib.sh文件，开头添加配置：JAVA_HOME=/usr/local/jdk1.7
数据流：file -> elasticsearch
添加输出到elasticsearch配置：es.conf
input {
    file {
        path => ["/home/app/log/*.log"]
        codec => "line"
        start_position => "end"
    }
}
filter {
    ruby {
        init => "@kname = ['datetime_','website','ip'']"
        code => "
            new_event = LogStash::Event.new(Hash[@kname.zip(event.get('message').split('    '))])
            new_event['array'] = new_event['datetime_'].split(' ')
            new_event['logdate'] = new_event['array'][0] + ' ' + new_event['array'][1]
            new_event['website'] = new_event['website'].split('=')[1]
            new_event.remove('@timestamp')
            event.append(new_event)"
            
        remove_field => ["datetime_","ip","array"]
    }
}

output {
    elasticsearch {
        hosts => ["199.155.122.166"]
        index => "log-report"
    }
}

 

二、elasticsearch

 

posted @ 2016-11-11 16:32  April.Chen  阅读(418)  评论(0)  编辑  收藏  举报