官網下載
https://www.elastic.co/cn/products/logstash
在logstash/config目錄創建配置文件logstash.config內容如下
#配置收集規則
input {
stdin {}
}
#配置過濾規則
filter {
grok {
match => {
"message" => "%{WORD} %{IP:client} %{WORD}"
}
}
}
#配置輸出規則
output {
elasticsearch {
hosts => ["10.116.69.4:9200" ]
action => "index"
codec => rubydebug
index => "%{type}-%{+YYYY.MM.dd}"
template_name => "%{type}"
}
}
啓動
nohup ./bin/logstash -f logstash.config &>nohup.log&