Logstash读取文本信息并写入到ES

Logstash读取文本信息并写入到ES

前提是ELK安装没问题

进入到logstash安装目录下的bin目录（我的logstash安装目录：/usr/local/）

[root@es1 bin]# cd /usr/local/logstash-5.5.2/bin

[root@es1 bin]# ll

total 100

-rwxr-xr-x 1 root root   377 Aug 14  2017 cpdump

-rw-r--r-- 1 root root 15821 Dec 27 00:58 hs_err_pid1888.log

-rw-r--r-- 1 root root 15821 Dec 27 01:01 hs_err_pid1929.log

-rw-r--r-- 1 root root 15821 Dec 27 01:05 hs_err_pid2026.log

-rwxr-xr-x 1 root root   155 Aug 14  2017 ingest-convert.sh

-rwxr-xr-x 1 root root  1949 Aug 14  2017 logstash

-rw-r--r-- 1 root root   677 Aug 14  2017 logstash.bat

-rw-r--r-- 1 root root   756 Dec 27 16:30 logstash.conf

-rwxr-xr-x 1 root root  5400 Aug 14  2017 logstash.lib.sh

-rwxr-xr-x 1 root root   448 Aug 14  2017 logstash-plugin

-rw-r--r-- 1 root root   251 Aug 14  2017 logstash-plugin.bat

-rw-r--r-- 1 root root  1138 Dec 27 17:21 mysqltoes.conf

-rwxr-xr-x 1 root root   840 Aug 14  2017 ruby

-rw-r--r-- 1 root root  2795 Aug 14  2017 setup.bat

-rwxr-xr-x 1 root root  3530 Aug 14  2017 system-install

修改logstash.conf文件

[root@es1 log]# vim /usr/local/logstash-5.5.2/bin/logstash.conf

#

input{

file{

path=>["/var/log/test.log"]

type=>"logstash_log"

start_position =>"beginning"

}

}

output{

elasticsearch{

hosts=>["192.168.100.101:9200","192.168.100.102:9200","192.168.100.103:9200"]

index=>"log-%{+YYYY.MM.dd.HH.mm.ss}"

}

}

运行

./logstash -f logstash.conf