ELK(4):ELK-安装logstash
ELK(4):安装logstash
Logstash是一个开源的服务器端数据收集引擎,可以水平伸缩。Logstash是ELK拥有最多插件的一个组件,可以同时从多个数据源获取数据,并对其进行转换,然后将其发送到你最喜欢的“存储”。(当然我们最喜欢的是Elasticsearch)
1 环境准备
关闭防火墙和selinux
java环境
[admin@pe-jira ~]$ getenforce Disabled [admin@pe-jira ~]$ sudo systemctl status firewalld ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled) Active: inactive (dead) [admin@pe-jira ~]$ getenforce Disabled [admin@pe-jira ~]$ java -version java version "1.8.0_212" Java(TM) SE Runtime Environment (build 1.8.0_212-b10) Java HotSpot(TM) 64-Bit Server VM (build 25.212-b10, mixed mode) [admin@pe-jira ~]$
2 安装
sudo rpm -ivh logstash-7.2.0.rpm
2.1 简单测试一下
/usr/share/logstash/bin/logstash -e 'input { stdin { } } output { stdout {codec => rubydebug} }'
3 收集系统日志到elasticsearch
3.1 配置文件
#cat /etc/logstash/conf.d/syslog.conf input { file { type => "systemlog-pe-jira" #标签 path => "/var/log/messages" #采集点 start_position => "beginning" #开始收集点 stat_interval => "2" #扫描间隔时间,默认是1s,建议5s } } output { elasticsearch { hosts => ["10.6.76.27:9200"] index => "logstash-system-log-pe-jira-%{+YYYY.MM.dd}" } file { path => "/tmp/123.log" } }
3.2 检验配置文件
/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/syslog.conf -t
3.3 修改系统日志权限
/var/log/messages 权限是600 logstash启动用户是logstash,是没有权限读的
[root@pe-jira ~]# ls -l /var/log/messages
-rw------- 1 root root 773045 7月 11 14:36 /var/log/messages
[root@pe-jira ~]# chmod 644 /var/log/messages
[root@pe-jira ~]#
3.4 启动logstash
sudo systemctl start logstash
3.5 elasticsearch查看