Logstash收集日誌
阿新 • • 發佈:2020-08-22
1.Logstash的配置檔案
[root@web01 ~]# vim /etc/logstash/logstash.yml
path.config: /etc/logstash/conf.d
2.logstash收集日誌檔案到檔案
[root@web01 ~]# vim /etc/logstash/conf.d/file_file.conf input { file { path => "/var/log/messages" start_position => "beginning" } } output { file { path => "/tmp/messages_%{+YYYY-MM-dd}.log" } }
3.logstash收集日誌檔案到ES
[root@web01 ~]# vim /etc/logstash/conf.d/file_es.conf input { file { path => "/var/log/messages" start_position => "beginning" } } output { elasticsearch { hosts => ["172.16.1.51:9200"] index => "messages_%{+YYYY-MM-dd}.log" } }
4.Logstash收集多日誌到檔案
[root@web01 ~]# vim /etc/logstash/conf.d/file_file.conf input { file { type => "messages_log" path => "/var/log/messages" start_position => "beginning" } file { type => "secure_log" path => "/var/log/secure" start_position => "beginning" } } output { if [type] == "messages_log" { file { path => "/tmp/messages_%{+YYYY-MM-dd}" } } if [type] == "secure_log" { file { path => "/tmp/secure_%{+YYYY-MM-dd}" } } }
5.Logstash收集多日誌到ES
1)方法一:
[root@web01 ~]# vim /etc/logstash/conf.d/more_es.conf
input {
file {
type => "messages_log"
path => "/var/log/messages"
start_position => "beginning"
}
file {
type => "secure_log"
path => "/var/log/secure"
start_position => "beginning"
}
}
output {
if [type] == "messages_log" {
elasticsearch {
hosts => ["10.0.0.51:9200"]
index => "messages_%{+YYYY-MM-dd}"
}
}
if [type] == "secure_log" {
elasticsearch {
hosts => ["10.0.0.51:9200"]
index => "secure_%{+YYYY-MM-dd}"
}
}
}
[root@web01 ~]# /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/more_es.conf &
#啟動後檢視頁面
2)方法二:
[root@web01 ~]# vim /etc/logstash/conf.d/more_es_2.conf
input {
file {
type => "messages_log"
path => "/var/log/messages"
start_position => "beginning"
}
file {
type => "secure_log"
path => "/var/log/secure"
start_position => "beginning"
}
}
output {
elasticsearch {
hosts => ["10.0.0.51:9200"]
index => "%{type}_%{+YYYY-MM-dd}"
}
}
[root@web01 ~]# /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/more_es_2.conf --path.data=/data/logstash/more_es_2 &
3)啟動多例項
#建立不同的資料目錄
[root@web01 ~]# mkdir /data/logstash/more_es_2
[root@web01 ~]# mkdir /data/logstash/more_es
#啟動時使用--path.data指定資料目錄
[root@web01 ~]# /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/more_es.conf --path.data=/data/logstash/more_es &
[root@web01 ~]# /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/more_es_2.conf --path.data=/data/logstash/more_es_2 &
#如果資源充足,可以使用多例項收集多日誌,如果伺服器資源不足,啟動不了多例項,配置一個檔案收集多日誌啟動