[TOC] ### 安装 >下载yum源的密钥认证： # `rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch ` >利用yum安装logstash： # `yum install -y logstash` >查看下logstash的安装目录 ：# `rpm -ql logstash ` >创建一个软连接，每次执行命令的时候不用在写安装路劲（默认安装在/usr/share下） > `ln -s /usr/share/logstash/bin/logstash /bin/` ### 安装 ``` #导入Yum源： rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch cd /etc/yum.repos.d/ vim logstash.repo [logstash-6.x] name=Elastic repository for 6.x packages baseurl=https://artifacts.elastic.co/packages/6.x/yum gpgcheck=1 gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch enabled=1 autorefresh=1 type=rpm-md #安装Logstash yum clean all sudo yum install logstash #启动Logstash服务 systemctl start logstash.service #设置开机自启动 systemctl enable logstash.service ``` ``` # 简单示例 bin/logstash -e 'input { stdin { } } output { stdout {} }' #　输入 input { ... } # 过滤器 filter { ... } # 输出 output { # 标准输出 stdout { codec => rubydebug } } ``` ### 配置文件运行 logstash ``` # bin/logstash -f logstash.conf # 从文件读取日志信息 input { file { path => "/var/log/messages" type => "system" start_position => "beginning" } } output { # 输出到 elasticsearch elasticsearch { hosts => ["192.168.10.224:9200"] index => "system-%{+YYYY.MM.dd}" } } ``` ### 实战配置 ``` input { file { path => "/var/log/messages" type => "system" start_position => "beginning" } file { path => "/var/log/secure" type => "secure" start_position => "beginning" } file { path => "/var/log/httpd/access_log" type => "http" start_position => "beginning" } file { path => "/usr/local/nginx/logs/elk.access.log" type => "nginx" start_position => "beginning" } } output { if [type] == "system" { elasticsearch { hosts => ["192.168.1.202:9200"] index => "nagios-system-%{+YYYY.MM.dd}" } } if [type] == "secure" { elasticsearch { hosts => ["192.168.1.202:9200"] index => "nagios-secure-%{+YYYY.MM.dd}" } } if [type] == "http" { elasticsearch { hosts => ["192.168.1.202:9200"] index => "nagios-http-%{+YYYY.MM.dd}" } } if [type] == "nginx" { elasticsearch { hosts => ["192.168.1.202:9200"] index => "nagios-nginx-%{+YYYY.MM.dd}" } } } ```