logstash收集日志文件详细操作步骤l

java -jar lsdemo.jar 0 10000

touch logsta.log

vi logsta.log

把下面得内容粘贴进logsta.log 中

input{
	file{
		path => "/root/ls/log/mylog.log"
		start_position => "beginning"
 		sincedb_path => "/dev/null"
		type => "go"
	}
}

filter{
   	if[type] == "go"{
		grok{
			match => {"message" => "userId:(?[0-9]+)\|clickCount:(?[0-9]+)\|eventName:(?[a-zA-Z_]+)\|clickTime:(?[0-9-]+)\|browser:(?[a-z0-9]+)\|timeZone:(?[A-Z]+)"}
			remove_field =>["message"]
		}
	}
}

output{
	if[type] == "go"{
                elasticsearch{
                        hosts => ["http://192.168.203.132:9200","http://192.168.203.142:9200","http://192.168.203.152:9200"]
                        index => "logstashdb"
                        document_type => "behaviour"
                }
        }
}

到logstash6-2-2所在的解压缩文件所在的bin目录下执行下面的语句

nohup ./logstash -f ~/ls/logsta.log