-
JDK 环境检查
-
logstash下载
-
下载
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
-
添加文件
cd /etc/yum.repos.d
touch logstash.repo
vi logstash.repo
添加下面内容到logstash.repo
[logstash-7.x]
name=Elastic repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
-
执行
sudo yum install logstash
-
logstash 运行
cd /usr/share/logstash/bin
[root@ecs-s6-large-2-linux-20190906115149 bin]# systemctl stop logstash.service
[root@ecs-s6-large-2-linux-20190906115149 bin]# ./logstash -e 'input { stdin { } } output { stdout {} }'
Thread.exclusive is deprecated, use Thread::Mutex
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN ] 2019-09-12 16:07:04.466 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2019-09-12 16:07:04.477 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"7.3.1"}
[INFO ] 2019-09-12 16:07:05.512 [Converge PipelineAction::Create<main>] Reflections - Reflections took 38 ms to scan 1 urls, producing 19 keys and 39 values
[WARN ] 2019-09-12 16:07:06.271 [[main]-pipeline-manager] LazyDelegatingGauge - A gauge metric of an unknown type (org.jruby.RubyArray) has been create for key: cluster_uuids. This may result in invalid serialization. It is recommended to log an issue to the responsible developer/development team.
[INFO ] 2019-09-12 16:07:06.274 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>250, :thread=>"#<Thread:0x131cf46e run>"}
[INFO ] 2019-09-12 16:07:06.393 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}
The stdin plugin is now waiting for input:
[INFO ] 2019-09-12 16:07:06.547 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[INFO ] 2019-09-12 16:07:06.959 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
控制台运行成功
Thread.exclusive is deprecated, use Thread::Mutex
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[FATAL] 2019-09-12 16:14:28.766 [main] runner - An unexpected error occurred! {:error=>#<ArgumentError: Path "/usr/share/logstash/data" must be a writable directory. It is not writable.>, :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:447:in `validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:229:in `validate_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:140:in `block in validate_all'", "org/jruby/RubyHash.java:1419:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:139:in `validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:283:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:242:in `run'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:73:in `<main>'"]}
[ERROR] 2019-09-12 16:14:28.787 [main] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[
控制台运行报错(这个我的解决方案是切换成root 就好了)
hello
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/awesome_print-1.7.0/lib/awesome_print/formatters/base_formatter.rb:31: warning: constant ::Fixnum is deprecated
{
"@version" => "1",
"@timestamp" => 2019-09-12T08:07:16.767Z,
"message" => "hello",
"host" => "ecs-s6-large-2-linux-20190906115149"
}
测试成功了
-
logstash 后台运行
cd /etc/logstash/conf.d
touch test.conf
将如下内容写到 test.conf 里面
input {
tcp {
port => 9100
mode => "server"
tags => ["tags"]
codec => json_lines
}
}
output {
stdout { codec => "rubydebug" }
file {
path => "/var/log/logstash/%{+yyyy}/%{+MM}/%{+dd-HH}-%{host}.log"
codec => "rubydebug"
}
elasticsearch {
hosts => ["119.3.185.186:9200"] # 定义es服务器的ip
index => "system-syslog-%{+YYYY.MM}" # 定义索引
}
}
input 监听 服务器 9100端口的消息，
output stdout 输出到控制台
file 输出到文件
elasticsearch 输出到 elasticsearch
-
执行
在 /usr/share/logstash 添加
touch startUp.sh
chmod 777 startUp.sh
在startUp.sh 中添加
nohup bin/logstash -f /etc/logstash/conf.d/test.conf &
注意 /etc/logstash/conf.d/test.conf 为你的conf 配置位置
-
修改/etc/logstash/logstash.yml
http.host: "0.0.0.0"
注意： 为了外部可以远程连接到当前logstash 服务
-
运行
cd /usr/share/logstash
./startup.sh
tail -f nohup.out
看到
[INFO ] 2019-09-12 17:59:18.124 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}
[INFO ] 2019-09-12 17:59:18.187 [[main]<tcp] tcp - Starting tcp input listener {:address=>"0.0.0.0:9100", :ssl_enable=>"false"}
[INFO ] 2019-09-12 17:59:18.378 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[INFO ] 2019-09-12 17:59:18.986 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
就启动成功了
-
测试
[root@ecs-s6-large-2-linux-20190828090356 logstash]# netstat -lntp |grep 9100
tcp 0 0 :::9100 :::* LISTEN 10533/java
[root@ecs-s6-large-2-linux-20190828090356 logstash]# netstat -lntp |grep 9600
tcp 0 0 ::ffff:127.0.0.1:9600 :::* LISTEN 10533/java
就成功了
