Logstash基础配置

ELK架构

1636239217288.png

Logstash

Logstash架构

1636239260895.png

Logstash部署

安装jdk

[root@es2 ~]# yum install java-1.8.0-openjdk –y

配置文件

[root@es2 config]# vi logstash.yml

pipeline.batch.size: 125
pipeline.batch.delay: 5
path.config: /opt/elk/logstash/conf.d # conf.d
# config.reload.automatic: false
# config.reload.interval: 3s
# http.enabled: true
http.host: 0.0.0.0
http.port: 9600-9700
log.level: info
path.logs: /opt/elk/logstash/logs
------------------------------------------------------------------------

配置规则

[root@es2 conf.d]# vi test.conf

input {
  file {
    path => "/var/log/test/*.log"
    exclude => "error.log"
    tags => "web"
    tags => "nginx"
    type => "access"
    add_field => {
      "project" => "microservice"
      "app" => "product"
    }
  }
}
filter {
}
output {
  file {
    path => "/tmp/test.log"
  }
}

------------------------------------------------------------------------

配置服务

[root@es2 conf.d]# vi /usr/lib/systemd/system/logstash.service 

[Unit]
Description=logstash
[Service]
ExecStart=/opt/elk/logstash/bin/logstash
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
[Install]
WantedBy=multi-user.target
------------------------------------------------------------------------------------
[root@es2 conf.d]# systemctl daemon-reload 
[root@es2 conf.d]# systemctl start logstash

[root@es2 test]# journalctl -u logstash -f

测试验证

[root@es2 config]# cd /var/log/test
[root@es2 test]# echo "555" >> 1.log    

[root@es2 test]# cat /tmp/test.log   

{
    "type": "access",
    "message": "555",
    "app": "product",
    "project": "microservice",
    "@version": "1",
    "@timestamp": "2021-11-04T09:07:35.500Z",
    "path": "/var/log/test/1.log",
    "host": "es2",
    "tags": [
        "web",
        "nginx"
    ]
}

kibana

配置文件

[root@es1 config]# vi kibana.yml
server.port: 5601
server.host: "0.0.0.0"
elasticsearch.hosts: ["http://192.168.153.25:9200"]
i18n.locale: "zh-CN"

配置服务

[root@es1 config]# vi /usr/lib/systemd/system/kibana.service

[Unit]
Description=kibana
[Service]
ExecStart=/opt/elk/kibana/bin/kibana --allow-root
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
[Install]
WantedBy=multi-user.targe


------------------------------------------------------------------------------------
[root@es2 conf.d]# systemctl daemon-reload 
[root@es2 conf.d]# systemctl start kibana

[root@es2 test]# journalctl -u kibana -f