logstash从不同服务器收集日志到一台总服务

95 阅读 0 评论 63 点赞

我是靠谱客的博主舒服小白菜，这篇文章主要介绍logstash从不同服务器收集日志到一台总服务，现在分享给大家，希望可以做个参考。

1，wget https://artifacts.elastic.co/downloads/logstash/logstash-6.4.2.tar.gz
2，tar -zxvf logstash-6.4.2.tar.gz
3，cd /opt/tmp/logstash-6.4.2
4,在终端中，像下面这样运行命令来启动 Logstash 进程：

复制代码

1
2
# bin/logstash -e 'input{stdin{}}output{stdout{codec=>rubydebug}}'

然后你会发现终端在等待你的输入。没问题，敲入 Hello World，回车，然后看看会返回什么结果！
安装成功！
5，配置服务端conf

复制代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
input {
tcp {
mode => "server"
port => 9600
ssl_enable => false
}
}
filter {
json {
source => "message"
}
}
output {
file {
path => "/opt/lampp/crm_ceshi/logECO/%{+YYYY-MM-dd}/%{servip}-%{filename}"
codec => line { format => "%{message}"}
}
}

启动bin/logstash -f config/logstash-server.conf

6,另一台需要收集的客户端配置

复制代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
input{
file {
path => ["/opt/lampp/crm_ceshi/logECO/2018-10-30/agreeRefundToElemeV2.txt"]
type => "ecolog"
start_position => "beginning"
sincedb_path => "/opt/tmp/logstash-6.4.2/data/plugins/inputs/file/.sincedb_3f3dc7129f441b61d81b1acadb65ed4e"
}
}
filter {
if [type] =~ /^ecolog/ {
ruby {
code => "file_name = event.get('path').split('/')[-1]
event.set('file_name',file_name)
event.set('servip','客户端IP')"
}
mutate {
rename => {"file_name" => "filename"}
}
}
}
output {
tcp {
host
=> "服务端ip"
port
=> 9600
codec => json_lines
}
}