檢視版本

lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 14.04.5 LTS
Release: 14.04
Codename: trusty

解除安裝deb版本的logstash

cp /etc/logstash/conf.d/*.conf    /bak
service stop logstash  
dpkg -P logstash

rm /usr/share/logstash
rm /etc/logstash
rm /var/lib/logstash
rm /var/log/logstash

下載對應版本的logstash

wget https://artifacts.elastic.co/downloads/logstash/logstash-5.3.1.zip
unzip logstash-5.3.1.zip -d /data/software/
ln -sv logstash-5.3.1 logstash
cd logstash

編輯配置檔案

vim config/logstash.yml 

pipeline.workers: 8
pipeline.output.workers: 8
pipeline.batch.size: 10000
pipeline.batch.delay: 10

vim config/jvm.options 
-Xms2g
-Xmx2g
 

建立配置檔案

mkdir conf.d
touch conf.d/index.conf   # 業務配置檔案
mkdir data/data{1,2,3,4,5}
mkdir logs/log{1,2,3,4,5}

useradd elk 
chown -R elk.elk data/
chown -R elk.elk logs/

安裝supervisor

pip install supervisor
mkdir /etc/supervisor

建立主配置檔案

cat >>  supervisord.conf  <<EOF  
; supervisor config file

[unix_http_server]
file=/var/run/supervisor.sock   ; (the path to the socket file)
chmod=0700                       ; sockef file mode (default 0700)

[supervisord]
logfile=/var/log/supervisor/supervisord.log ; (main log file;default $CWD/supervisord.log)
pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
childlogdir=/var/log/supervisor            ; ('AUTO' child log dir, default $TEMP)

; the below section must remain in the config file for RPC
; (supervisorctl/web interface) to work, additional interfaces may be
; added by defining them in separate rpcinterface: sections
[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

[supervisorctl]
serverurl=unix:///var/run/supervisor.sock ; use a unix:// URL  for a unix socket

; The [include] section can just contain the "files" setting.  This
; setting can list multiple files (separated by whitespace or
; newlines).  It can also contain wildcards.  The filenames are
; interpreted as relative to this file.  Included files *cannot*
; include files themselves.

[include]
files = /etc/supervisor/conf.d/*.conf
EOF
 

建立相關路徑

cd /etc/supervisor
mkdir  conf.d/
mkdir /var/log/supervisor
mkdir /data/logs/supervisord/
cd conf.d/

建立子配置檔案

cat >> logstash1.conf  <<EOF
[program:logstash1]
directory = /data/software/logstash
command = /data/software/logstash/bin/logstash --path.data=/data/software/logstash/data/data1 -f  /data/software/logstash/conf.d/index.conf  -l /data/software/logstash/logs/log1
autostart = true
autorestart = true
redirect_stderr=false
startretries = 3
user = elk
stdout_logfile_maxbytes = 500MB
stdout_logfile_backups = 5
stdout_logfile = /data/logs/supervisord/logstash-index-stdout.log
stderr_logfile_maxbytes = 500MB
stderr_logfile_backups = 5
stderr_logfile = /data/logs/supervisord/logstash-index-stderr.log
EOF

啟動和執行

supervisord -c /etc/supervisor/supervisord.conf 
supervisorctl -c /etc/supervisor/supervisord.conf

supervisor 更改配置檔案，必須要重啟整個supervisor進場才能生效
supervisorctl -c /etc/supervisor/supervisord.conf shutdown 
supervisord -c /etc/supervisor/supervisord.conf