20 logstash 一篇就够

20.1 下载

<u>https://www.elastic.co/cn/downloads/logstash</u>

logstash-8.0.0-linux-x86_64.tar.gz

tar -zxvf logstash-8.0.0-linux-x86_64.tar.gz

mv logstash-8.0.0-linux-x86_64 logstash

mkdir -p /home/software/logstash/data

mkdir -p /home/software/logstash/logs

20.2 config

vim config/input-output.conf

input{

kafka{

bootstrap_servers => "172.16.10.4:9092,172.16.10.6:9092,172.16.10.7:9092"

topics => ["zysco_realtime"]

group_id => "logstash1"

type => "realtime"

}

filter{

grok{

match => ["message",""(?<data>([\S+]*))""]

}

output{

kafka{

bootstrap_servers => "localhost:9092"

topic_id => "zysco_realtime"

codec => line {

format => "%{message}"

}

./bin/logstash -f config/input-output.conf -t

需要多研究 grok

vim config/pipelines.yml

pipeline.id: id1

pipeline.workers: 1

path.config: "/home/software/logstash/config/input-output.conf"

20.3 自启动

nohup ./bin/logstash -f config/input-output.conf

vim /usr/lib/systemd/system/logstash.service

[Unit]

Description=logstash

After=network.target

[Service]

Type=simple

User=prometheus2

ExecStart=/home/software/logstash/bin/logstash -f /home/software/logstash/config/input-output.conf

Restart=on-failure

RestartSec=5

[Install]

WantedBy=multi-user.target

systemctl daemon-reload

systemctl enable logstash.service

systemctl start logstash.service

systemctl status logstash.service

systemctl stop logstash.service

systemctl restart logstash.service

20.4 手动启动和停止

nohup /home/software/logstash/bin/logstash -f /home/software/logstash/config/input-output.conf

ps -aux|grep logstash

Kill pid

20.4 文件读取、清洗过滤

结晶器专家项目应用（window版本）

1.源文件

*.mes_caster

2.input + filter

input {

file{

        path => "Z:/zhongyuan-ccm1_*/mex_cb_boExpert_*.mex_caster"

        start_position => "beginning"

        sincedb_path => "D:/logstash-7.3.2/data/plugins/inputs/file/dev/db-bo-expert"

        type => "boExpert"

    }

}

filter{

grok{

         match => {

             "message" => [

                "%{WORD};%{NUMBER};%{NUMBER};%{NUMBER};;;%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{WORD};;%{NUMBER};%{NUMBER};",

                "%{WORD};;%{NUMBER};;%{NUMBER};;%{NUMBER};;%{NUMBER};%{NUMBER};%{NUMBER};;%{NUMBER};%{NUMBER};%{WORD};%{WORD};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};;;%{NUMBER};%{NUMBER};%{NUMBER};%{WORD};;%{NUMBER};",

                "%{WORD};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{NUMBER};%{WORD};%{NUMBER};%{NUMBER};%{WORD};%{NUMBER};%{NUMBER};;%{NUMBER};%{NUMBER};"

             ]

         }

    }

if[type] == "boExpert"{

    mutate {

              split => ["message",";"]

              add_field => {"TIMESTAMP" => "%{[message][0]}"}

              add_field => {"castingSpeed" => "%{[message][1]}"}

              add_field => {"castingLength" => "%{[message][2]}"}

              add_field => {"moldLevel" => "%{[message][3]}"}

              add_field => {"moldLevelLimitLow" => "%{[message][4]}"}

              add_field => {"moldLevelLimitUpp" => "%{[message][5]}"}

              add_field => {"moldLevelDistance" => "%{[message][6]}"}

              add_field => {"SENImmersionDepth" => "%{[message][7]}"}

              add_field => {"stopper" => "%{[message][8]}"}

              add_field => {"superHeat" => "%{[message][9]}"}

              add_field => {"tundishTemperature" => "%{[message][10]}"}

              add_field => {"castMode" => "%{[message][11]}"}

              add_field => {"newSteelInMold" => "%{[message][12]}"}

              add_field => {"moldConfiguration" => "%{[message][13]}"}

              add_field => {"moldNumber" => "%{[message][14]}"}

              add_field => {"bff_c01_1" => "%{[message][15]}"}

              add_field => {"bff_c01_2" => "%{[message][16]}"}

              add_field => {"bff_c01_3" => "%{[message][17]}"}

              add_field => {"bff_c02_1" => "%{[message][18]}"}

              add_field => {"bff_c02_2" => "%{[message][19]}"}

              add_field => {"bff_c02_3" => "%{[message][20]}"}

              add_field => {"bff_c03_1" => "%{[message][21]}"}

              add_field => {"bff_c03_2" => "%{[message][22]}"}

              add_field => {"bff_c03_3" => "%{[message][23]}"}

              add_field => {"bff_c04_1" => "%{[message][24]}"}

              add_field => {"bff_c04_2" => "%{[message][25]}"}

              add_field => {"bff_c04_3" => "%{[message][26]}"}

              add_field => {"bff_c05_1" => "%{[message][27]}"}

              add_field => {"bff_c05_2" => "%{[message][28]}"}

              add_field => {"bff_c05_3" => "%{[message][29]}"}

              add_field => {"bff_c06_1" => "%{[message][30]}"}

              add_field => {"bff_c06_2" => "%{[message][31]}"}

              add_field => {"bff_c06_3" => "%{[message][32]}"}

              add_field => {"bff_c07_1" => "%{[message][33]}"}

              add_field => {"bff_c07_2" => "%{[message][34]}"}

              add_field => {"bff_c07_3" => "%{[message][35]}"}

              add_field => {"nfr_c01_1" => "%{[message][36]}"}

              add_field => {"nfr_c01_2" => "%{[message][37]}"}

              add_field => {"nfr_c01_3" => "%{[message][38]}"}

              add_field => {"bfl_c01_1" => "%{[message][39]}"}

              add_field => {"bfl_c01_2" => "%{[message][40]}"}

              add_field => {"bfl_c01_3" => "%{[message][41]}"}

              add_field => {"bfl_c02_1" => "%{[message][42]}"}

              add_field => {"bfl_c02_2" => "%{[message][43]}"}

              add_field => {"bfl_c02_3" => "%{[message][44]}"}

              add_field => {"bfl_c03_1" => "%{[message][45]}"}

              add_field => {"bfl_c03_2" => "%{[message][46]}"}

              add_field => {"bfl_c03_3" => "%{[message][47]}"}

              add_field => {"bfl_c04_1" => "%{[message][48]}"}

              add_field => {"bfl_c04_2" => "%{[message][49]}"}

              add_field => {"bfl_c04_3" => "%{[message][50]}"}

              add_field => {"bfl_c05_1" => "%{[message][51]}"}

              add_field => {"bfl_c05_2" => "%{[message][52]}"}

              add_field => {"bfl_c05_3" => "%{[message][53]}"}

              add_field => {"bfl_c06_1" => "%{[message][54]}"}

              add_field => {"bfl_c06_2" => "%{[message][55]}"}

              add_field => {"bfl_c06_3" => "%{[message][56]}"}

              add_field => {"nfl_c01_1" => "%{[message][57]}"}

              add_field => {"nfl_c01_2" => "%{[message][58]}"}

              add_field => {"nfl_c01_3" => "%{[message][59]}"}

              add_field => {"bff_disabled" => "%{[message][60]}"}

              add_field => {"nfr_disabled" => "%{[message][61]}"}

              add_field => {"bfl_disabled" => "%{[message][62]}"}

              add_field => {"nfl_disabled" => "%{[message][63]}"}

              add_field => {"castingSituation" => "%{[message][64]}"}

              add_field => {"castingConditions" => "%{[message][65]}"}

              add_field => {"BOP_alarms" => "%{[message][66]}"}

              add_field => {"stopCaster" => "%{[message][67]}"}

              add_field => {"BOP_strandPLCmode" => "%{[message][68]}"}

              remove_field => ["message"]

        }

        if [TIMESTAMP] == "TIMESTAMP" {

          mutate {remove_field => "TIMESTAMP"}

        }

        if [castingSpeed] == "castingSpeed" {

          mutate {remove_field => "castingSpeed"}

        }

        if [castingLength] == "castingLength" {

          mutate {remove_field => "castingLength"}

        }

        if [moldLevel] == "moldLevel" {

          mutate {remove_field => "moldLevel"}

        }

        if [moldLevelLimitLow] == "moldLevelLimitLow" {

          mutate {remove_field => "moldLevelLimitLow"}

        }

        if [moldLevelLimitUpp] == "moldLevelLimitUpp" {

          mutate {remove_field => "moldLevelLimitUpp"}

        }

        if [moldLevelDistance] == "moldLevelDistance" {

          mutate {remove_field => "moldLevelDistance"}

        }

        if [SENImmersionDepth] == "SENImmersionDepth" {

          mutate {remove_field => "SENImmersionDepth"}

        }

        if [stopper] == "stopper" {

          mutate {remove_field => "stopper"}

        }

        if [superHeat] == "superHeat" {

          mutate {remove_field => "superHeat"}

        }

        if [tundishTemperature] == "tundishTemperature" {

          mutate {remove_field => "tundishTemperature"}

        }

        if [castMode] == "castMode" {

          mutate {remove_field => "castMode"}

        }

        if [newSteelInMold] == "newSteelInMold" {

          mutate {remove_field => "newSteelInMold"}

        }

        if [moldConfiguration] == "moldConfiguration" {

          mutate {remove_field => "moldConfiguration"}

        }

        if [moldNumber] == "moldNumber" {

          mutate {remove_field => "moldNumber"}

        }

        if [bff_c01_1] == "bff_c01_1" {

          mutate {remove_field => "bff_c01_1"}

        }

        if [bff_c01_2] == "bff_c01_2" {

          mutate {remove_field => "bff_c01_2"}

        }

        if [bff_c01_3] == "bff_c01_3" {

          mutate {remove_field => "bff_c01_3"}

        }

        if [bff_c02_1] == "bff_c02_1" {

          mutate {remove_field => "bff_c02_1"}

        }

        if [bff_c02_2] == "bff_c02_2" {

          mutate {remove_field => "bff_c02_2"}

        }

        if [bff_c02_3] == "bff_c02_3" {

          mutate {remove_field => "bff_c02_3"}

        }

        if [bff_c03_1] == "bff_c03_1" {

          mutate {remove_field => "bff_c03_1"}

        }

        if [bff_c03_2] == "bff_c03_2" {

          mutate {remove_field => "bff_c03_2"}

        }

        if [bff_c03_3] == "bff_c03_3" {

          mutate {remove_field => "bff_c03_3"}

        }

        if [bff_c04_1] == "bff_c04_1" {

          mutate {remove_field => "bff_c04_1"}

        }

        if [bff_c04_2] == "bff_c04_2" {

          mutate {remove_field => "bff_c04_2"}

        }

        if [bff_c04_3] == "bff_c04_3" {

          mutate {remove_field => "bff_c04_3"}

        }

        if [bff_c05_1] == "bff_c05_1" {

          mutate {remove_field => "bff_c05_1"}

        }

        if [bff_c05_2] == "bff_c05_2" {

          mutate {remove_field => "bff_c05_2"}

        }

        if [bff_c05_3] == "bff_c05_3" {

          mutate {remove_field => "bff_c05_3"}

        }

        if [bff_c06_1] == "bff_c06_1" {

          mutate {remove_field => "bff_c06_1"}

        }

        if [bff_c06_2] == "bff_c06_2" {

          mutate {remove_field => "bff_c06_2"}

        }

        if [bff_c06_3] == "bff_c06_3" {

          mutate {remove_field => "bff_c06_3"}

        }

        if [bff_c07_1] == "bff_c07_1" {

          mutate {remove_field => "bff_c07_1"}

        }

        if [bff_c07_2] == "bff_c07_2" {

          mutate {remove_field => "bff_c07_2"}

        }

        if [bff_c07_3] == "bff_c07_3" {

          mutate {remove_field => "bff_c07_3"}

        }

        if [nfr_c01_1] == "nfr_c01_1" {

          mutate {remove_field => "nfr_c01_1"}

        }

        if [nfr_c01_2] == "nfr_c01_2" {

          mutate {remove_field => "nfr_c01_2"}

        }

        if [nfr_c01_3] == "nfr_c01_3" {

          mutate {remove_field => "nfr_c01_3"}

        }

        if [bfl_c01_1] == "bfl_c01_1" {

          mutate {remove_field => "bfl_c01_1"}

        }

        if [bfl_c01_2] == "bfl_c01_2" {

          mutate {remove_field => "bfl_c01_2"}

        }

        if [bfl_c01_3] == "bfl_c01_3" {

          mutate {remove_field => "bfl_c01_3"}

        }

        if [bfl_c02_1] == "bfl_c02_1" {

          mutate {remove_field => "bfl_c02_1"}

        }

        if [bfl_c02_2] == "bfl_c02_2" {

          mutate {remove_field => "bfl_c02_2"}

        }

        if [bfl_c02_3] == "bfl_c02_3" {

          mutate {remove_field => "bfl_c02_3"}

        }

        if [bfl_c03_1] == "bfl_c03_1" {

          mutate {remove_field => "bfl_c03_1"}

        }

        if [bfl_c03_2] == "bfl_c03_2" {

          mutate {remove_field => "bfl_c03_2"}

        }

        if [bfl_c03_3] == "bfl_c03_3" {

          mutate {remove_field => "bfl_c03_3"}

        }

        if [bfl_c04_1] == "bfl_c04_1" {

          mutate {remove_field => "bfl_c04_1"}

        }

        if [bfl_c04_2] == "bfl_c04_2" {

          mutate {remove_field => "bfl_c04_2"}

        }

        if [bfl_c04_3] == "bfl_c04_3" {

          mutate {remove_field => "bfl_c04_3"}

        }

        if [bfl_c05_1] == "bfl_c05_1" {

          mutate {remove_field => "bfl_c05_1"}

        }

        if [bfl_c05_2] == "bfl_c05_2" {

          mutate {remove_field => "bfl_c05_2"}

        }

        if [bfl_c05_3] == "bfl_c05_3" {

          mutate {remove_field => "bfl_c05_3"}

        }

        if [bfl_c06_1] == "bfl_c06_1" {

          mutate {remove_field => "bfl_c06_1"}

        }

        if [bfl_c06_2] == "bfl_c06_2" {

          mutate {remove_field => "bfl_c06_2"}

        }

        if [bfl_c06_3] == "bfl_c06_3" {

          mutate {remove_field => "bfl_c06_3"}

        }

        if [nfl_c01_1] == "nfl_c01_1" {

          mutate {remove_field => "nfl_c01_1"}

        }

        if [nfl_c01_2] == "nfl_c01_2" {

          mutate {remove_field => "nfl_c01_2"}

        }

        if [nfl_c01_3] == "nfl_c01_3" {

          mutate {remove_field => "nfl_c01_3"}

        }

        if [bff_disabled] == "bff_disabled" {

          mutate {remove_field => "bff_disabled"}

        }

        if [nfr_disabled] == "nfr_disabled" {

          mutate {remove_field => "nfr_disabled"}

        }

        if [bfl_disabled] == "bfl_disabled" {

          mutate {remove_field => "bfl_disabled"}

        }

        if [nfl_disabled] == "nfl_disabled" {

          mutate {remove_field => "nfl_disabled"}

        }

        if [castingSituation] == "castingSituation" {

          mutate {remove_field => "castingSituation"}

        }

        if [castingConditions] == "castingConditions" {

          mutate {remove_field => "castingConditions"}

        }

        if [BOP_alarms] == "BOP_alarms" {

          mutate {remove_field => "BOP_alarms"}

        }

        if [stopCaster] == "stopCaster" {

          mutate {remove_field => "stopCaster"}

        }

        if [BOP_strandPLCmode] == "BOP_strandPLCmode" {

          mutate {remove_field => "BOP_strandPLCmode"}

        }

        if [TIMESTAMP] == "%{[message][0]}" {

          mutate {remove_field => "TIMESTAMP"}

        }

        if [castingSpeed] == "%{[message][1]}" {

          mutate {remove_field => "castingSpeed"}

        }

        if [castingLength] == "%{[message][2]}" {

          mutate {remove_field => "castingLength"}

        }

        if [moldLevel] == "%{[message][3]}" {

          mutate {remove_field => "moldLevel"}

        }

        if [moldLevelLimitLow] == "%{[message][4]}" {

          mutate {remove_field => "moldLevelLimitLow"}

        }

        if [moldLevelLimitUpp] == "%{[message][5]}" {

          mutate {remove_field => "moldLevelLimitUpp"}

        }

        if [moldLevelDistance] == "%{[message][6]}" {

          mutate {remove_field => "moldLevelDistance"}

        }

        if [SENImmersionDepth] == "%{[message][7]}" {

          mutate {remove_field => "SENImmersionDepth"}

        }

        if [stopper] == "%{[message][8]}" {

          mutate {remove_field => "stopper"}

        }

        if [superHeat] == "%{[message][9]}" {

          mutate {remove_field => "superHeat"}

        }

        if [tundishTemperature] == "%{[message][10]}" {

          mutate {remove_field => "tundishTemperature"}

        }

        if [castMode] == "%{[message][11]}" {

          mutate {remove_field => "castMode"}

        }

        if [newSteelInMold] == "%{[message][12]}" {

          mutate {remove_field => "newSteelInMold"}

        }

        if [moldConfiguration] == "%{[message][13]}" {

          mutate {remove_field => "moldConfiguration"}

        }

        if [moldNumber] == "%{[message][14]}" {

          mutate {remove_field => "moldNumber"}

        }

        if [bff_c01_1] == "%{[message][15]}" {

          mutate {remove_field => "bff_c01_1"}

        }

        if [bff_c01_2] == "%{[message][16]}" {

          mutate {remove_field => "bff_c01_2"}

        }

        if [bff_c01_3] == "%{[message][17]}" {

          mutate {remove_field => "bff_c01_3"}

        }

        if [bff_c02_1] == "%{[message][18]}" {

          mutate {remove_field => "bff_c02_1"}

        }

        if [bff_c02_2] == "%{[message][19]}" {

          mutate {remove_field => "bff_c02_2"}

        }

        if [bff_c02_3] == "%{[message][20]}" {

          mutate {remove_field => "bff_c02_3"}

        }

        if [bff_c03_1] == "%{[message][21]}" {

          mutate {remove_field => "bff_c03_1"}

        }

        if [bff_c03_2] == "%{[message][22]}" {

          mutate {remove_field => "bff_c03_2"}

        }

        if [bff_c03_3] == "%{[message][23]}" {

          mutate {remove_field => "bff_c03_3"}

        }

        if [bff_c04_1] == "%{[message][24]}" {

          mutate {remove_field => "bff_c04_1"}

        }

        if [bff_c04_2] == "%{[message][25]}" {

          mutate {remove_field => "bff_c04_2"}

        }

        if [bff_c04_3] == "%{[message][26]}" {

          mutate {remove_field => "bff_c04_3"}

        }

        if [bff_c05_1] == "%{[message][27]}" {

          mutate {remove_field => "bff_c05_1"}

        }

        if [bff_c05_2] == "%{[message][28]}" {

          mutate {remove_field => "bff_c05_2"}

        }

        if [bff_c05_3] == "%{[message][29]}" {

          mutate {remove_field => "bff_c05_3"}

        }

        if [bff_c06_1] == "%{[message][30]}" {

          mutate {remove_field => "bff_c06_1"}

        }

        if [bff_c06_2] == "%{[message][31]}" {

          mutate {remove_field => "bff_c06_2"}

        }

        if [bff_c06_3] == "%{[message][32]}" {

          mutate {remove_field => "bff_c06_3"}

        }

        if [bff_c07_1] == "%{[message][33]}" {

          mutate {remove_field => "bff_c07_1"}

        }

        if [bff_c07_2] == "%{[message][34]}" {

          mutate {remove_field => "bff_c07_2"}

        }

        if [bff_c07_3] == "%{[message][35]}" {

          mutate {remove_field => "bff_c07_3"}

        }

        if [nfr_c01_1] == "%{[message][36]}" {

          mutate {remove_field => "nfr_c01_1"}

        }

        if [nfr_c01_2] == "%{[message][37]}" {

          mutate {remove_field => "nfr_c01_2"}

        }

        if [nfr_c01_3] == "%{[message][38]}" {

          mutate {remove_field => "nfr_c01_3"}

        }

        if [bfl_c01_1] == "%{[message][39]}" {

          mutate {remove_field => "bfl_c01_1"}

        }

        if [bfl_c01_2] == "%{[message][40]}" {

          mutate {remove_field => "bfl_c01_2"}

        }

        if [bfl_c01_3] == "%{[message][41]}" {

          mutate {remove_field => "bfl_c01_3"}

        }

        if [bfl_c02_1] == "%{[message][42]}" {

          mutate {remove_field => "bfl_c02_1"}

        }

        if [bfl_c02_2] == "%{[message][43]}" {

          mutate {remove_field => "bfl_c02_2"}

        }

        if [bfl_c02_3] == "%{[message][44]}" {

          mutate {remove_field => "bfl_c02_3"}

        }

        if [bfl_c03_1] == "%{[message][45]}" {

          mutate {remove_field => "bfl_c03_1"}

        }

        if [bfl_c03_2] == "%{[message][46]}" {

          mutate {remove_field => "bfl_c03_2"}

        }

        if [bfl_c03_3] == "%{[message][47]}" {

          mutate {remove_field => "bfl_c03_3"}

        }

        if [bfl_c04_1] == "%{[message][48]}" {

          mutate {remove_field => "bfl_c04_1"}

        }

        if [bfl_c04_2] == "%{[message][49]}" {

          mutate {remove_field => "bfl_c04_2"}

        }

        if [bfl_c04_3] == "%{[message][50]}" {

          mutate {remove_field => "bfl_c04_3"}

        }

        if [bfl_c05_1] == "%{[message][51]}" {

          mutate {remove_field => "bfl_c05_1"}

        }

        if [bfl_c05_2] == "%{[message][52]}" {

          mutate {remove_field => "bfl_c05_2"}

        }

        if [bfl_c05_3] == "%{[message][53]}" {

          mutate {remove_field => "bfl_c05_3"}

        }

        if [bfl_c06_1] == "%{[message][54]}" {

          mutate {remove_field => "bfl_c06_1"}

        }

        if [bfl_c06_2] == "%{[message][55]}" {

          mutate {remove_field => "bfl_c06_2"}

        }

        if [bfl_c06_3] == "%{[message][56]}" {

          mutate {remove_field => "bfl_c06_3"}

        }

        if [nfl_c01_1] == "%{[message][57]}" {

          mutate {remove_field => "nfl_c01_1"}

        }

        if [nfl_c01_2] == "%{[message][58]}" {

          mutate {remove_field => "nfl_c01_2"}

        }

        if [nfl_c01_3] == "%{[message][59]}" {

          mutate {remove_field => "nfl_c01_3"}

        }

        if [bff_disabled] == "%{[message][60]}" {

          mutate {remove_field => "bff_disabled"}

        }

        if [nfr_disabled] == "%{[message][61]}" {

          mutate {remove_field => "nfr_disabled"}

        }

        if [bfl_disabled] == "%{[message][62]}" {

          mutate {remove_field => "bfl_disabled"}

        }

        if [nfl_disabled] == "%{[message][63]}" {

          mutate {remove_field => "nfl_disabled"}

        }

        if [castingSituation] == "%{[message][64]}" {

          mutate {remove_field => "castingSituation"}

        }

        if [castingConditions] == "%{[message][65]}" {

          mutate {remove_field => "castingConditions"}

        }

        if [BOP_alarms] == "%{[message][66]}" {

          mutate {remove_field => "BOP_alarms"}

        }

        if [stopCaster] == "%{[message][67]}" {

          mutate {remove_field => "stopCaster"}

        }

        if [BOP_strandPLCmode] == "%{[message][68]}" {

          mutate {remove_field => "BOP_strandPLCmode"}

        }

}

}

3.output

output {

stdout{

    codec => rubydebug

}

mqtt{

    host => "172.16.10.5"

    port => 1883

    topic => "test"

    client_id => "starquest"

    username => "starquest"

    password => "starquest"

}

}

4.启动

logstash.bat -f mex

mex 为当前文件夹下的配置文件

多实例启动

logstash.bat -f mex2 --path.data=/path/data

5.重要的文件目录

配置文件目录 D:\logstash-7.3.2\bin\mex

记录已读取地址 D:\logstash-7.3.2\data\plugins\inputs\file\dev

日志路径 D:\logstash-7.3.2\logs

禁止转载，如需转载请通过简信或评论联系作者。

人面猴
序言：七十年代末，一起剥皮案震惊了整个滨河市，随后出现的几起案子，更是在滨河造成了极大的恐慌，老刑警刘岩，带你破解...
沈念sama阅读 204,293评论 6赞 478
死咒
序言：滨河连续发生了三起死亡事件，死亡现场离奇诡异，居然都是意外死亡，警方通过查阅死者的电脑和手机，发现死者居然都...
沈念sama阅读 85,604评论 2赞 381
救了他两次的神仙让他今天三更去死
文/潘晓璐我一进店门，熙熙楼的掌柜王于贵愁眉苦脸地迎上来，“玉大人，你说我怎么就摊上这事。” “怎么了？”我有些...
开封第一讲书人阅读 150,958评论 0赞 337
道士缉凶录：失踪的卖姜人
文/不坏的土叔我叫张陵，是天一观的道长。经常有香客问我，道长，这世上最难降的妖魔是什么？我笑而不...
开封第一讲书人阅读 54,729评论 1赞 277
港岛之恋（遗憾婚礼）
正文为了忘掉前任，我火速办了婚礼，结果婚礼上，老公的妹妹穿的比我还像新娘。我一直安慰自己，他们只是感情好，可当我...
茶点故事阅读 63,719评论 5赞 366
恶毒庶女顶嫁案：这布局不是一般人想出来的
文/花漫我一把揭开白布。她就那样静静地躺着，像睡着了一般。火红的嫁衣衬着肌肤如雪。梳的纹丝不乱的头发上，一...
开封第一讲书人阅读 48,630评论 1赞 281
城市分裂传说
那天，我揣着相机与录音，去河边找鬼。笑死，一个胖子当着我的面吹牛，可吹牛的内容都是我干的。我是一名探鬼主播，决...
沈念sama阅读 38,000评论 3赞 397
双鸳鸯连环套：你想象不到人心有多黑
文/苍兰香墨我猛地睁开眼，长吁一口气：“原来是场噩梦啊……” “哼！你这毒妇竟也来了？” 一声冷哼从身侧响起，我...
开封第一讲书人阅读 36,665评论 0赞 258
万荣杀人案实录
序言：老挝万荣一对情侣失踪，失踪者是张志新（化名）和其女友刘颖，没想到半个月后，有当地人在树林里发现了一具尸体，经...
沈念sama阅读 40,909评论 1赞 299
护林员之死
正文独居荒郊野岭守林人离奇死亡，尸身上长有42处带血的脓包…… 初始之章·张勋以下内容为张勋视角年9月15日...
茶点故事阅读 35,646评论 2赞 321
白月光启示录
正文我和宋清朗相恋三年，在试婚纱的时候发现自己被绿了。大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
茶点故事阅读 37,726评论 1赞 330
活死人
序言：一个原本活蹦乱跳的男人离奇死亡，死状恐怖，灵堂内的尸体忽然破棺而出，到底是诈尸还是另有隐情，我是刑警宁泽，带...
沈念sama阅读 33,400评论 4赞 321
日本核电站爆炸内幕
正文年R本政府宣布，位于F岛的核电站，受9级特大地震影响，放射性物质发生泄漏。R本人自食恶果不足惜，却给世界环境...
茶点故事阅读 38,986评论 3赞 307
男人毒药：我在死后第九天来索命
文/蒙蒙一、第九天我趴在偏房一处隐蔽的房顶上张望。院中可真热闹，春花似锦、人声如沸。这庄子的主人今日做“春日...
开封第一讲书人阅读 29,959评论 0赞 19
一桩弑父案，背后竟有这般阴谋
文/苍兰香墨我抬头看了看天上的太阳。三九已至，却和暖如春，着一层夹袄步出监牢的瞬间，已是汗流浃背。一阵脚步声响...
开封第一讲书人阅读 31,197评论 1赞 260
情欲美人皮
我被黑心中介骗来泰国打工，没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留，地道东北人。一个月前我还...
沈念sama阅读 44,996评论 2赞 349
代替公主和亲
正文我出身青楼，却偏偏与公主长得像，于是被迫代替她去往敌国和亲。传闻我的和亲对象是个残疾皇子，可洞房花烛夜当晚...
茶点故事阅读 42,481评论 2赞 342