ELK部署

一、logstash

版本：2.4.0

要求：Java 7 +

下载：https://download.elastic.co/logstash/logstash/logstash-2.4.0.tar.gz

配置：系统java 1.6，修改bin/logstash.lib.sh文件，开头添加配置：JAVA_HOME=/usr/local/jdk1.7

数据流：file -> elasticsearch

添加输出到elasticsearch配置：es.conf

input {
    file {
        path => ["/home/app/log/*.log"]
        codec => "line"
        start_position => "end"
    }
}
filter {
    ruby {
        init => "@kname = ['datetime_','website','ip'']"
        code => "
            new_event = LogStash::Event.new(Hash[@kname.zip(event.get('message').split('    '))])
            new_event['array'] = new_event['datetime_'].split(' ')
            new_event['logdate'] = new_event['array'][0] + ' ' + new_event['array'][1]
            new_event['website'] = new_event['website'].split('=')[1]
            new_event.remove('@timestamp')
            event.append(new_event)"

        remove_field => ["datetime_","ip","array"]
    }
}

output {
    elasticsearch {
        hosts => ["199.155.122.166"]
        index => "log-report"
    }
}

二、elasticsearch