搭建ELK

安装包

相关安装包
提取码：kitp

ElasticSearch

下载ElasteicSearch安装包解压后在bin目录下直接双击elasticsearch.bat启动，浏览器访问localhost:9200查看是否启动成功

Kibana

下载后解压，在bin目录下双击kibana.bat启动，浏览器访问localhost:5601

Lagstash

Logstash的下载地址：https://www.elastic.co/cn/downloads/logstash

1. 下载测试数据集，下载地址：http://files.grouplens.org/datasets/movielens/，在该网页中下载ml-latest.zip，下载后解压目录，将movies.csv文件(此文件是数据集)拷贝到指定的目录下，例如：D:/logstash/ 目录。
2. 进入到Logstash的解压目录，进入到config目录下，新建logstash.conf，文件内容如下:

input {
  file {
    # movies,csv文件的位置
    path => "D:/logstash/movies.csv"
    start_position => "beginning"
    #指定输入日志文件的路径
    sincedb_path => "D:/logstash/db_path.log"
  }
}
filter {
  csv {
    separator => ","
    columns => ["id","content","genre"]
  }

  mutate {
    split => { "genre" => "|" }
    remove_field => ["path", "host","@timestamp","message"]
  }

  mutate {

    split => ["content", "("]
    add_field => { "title" => "%{[content][0]}"}
    add_field => { "year" => "%{[content][1]}"}
  }

  mutate {
    convert => {
      "year" => "integer"
    }
    strip => ["title"]
    remove_field => ["path", "host","@timestamp","message","content"]
  }

}
output {
   elasticsearch {
     hosts => "http://192.168.31.173:9200"
     index => "movies"
     document_id => "%{id}"
   }
  stdout {}
}

3. 在命令行进入到logstash的bin目录下，输入如下命令,指定配置文件，启动Logstash:

logstash.bat -f D:\logstash\config\logstash.conf