查看ES中有那些索引
curl 10.19.14.40:9200/_cat/indices
基于入口redis启动logstash
# cat logstash_to_redis.conf
input { stdin { } }
output {
stdout { codec => rubydebug }
redis {
host => ‘192.168.1.104‘
data_type => ‘list‘
key => ‘logstash:redis‘
}
}
# logstash agent -f logstash_to_redis.conf --verbose
Pipeline started {:level=>:info}
Logstash startup completed
dajihao linux
{
"message" => "dajihao linux",
"@version" => "1",
"@timestamp" => "2015-10-08T14:42:07.550Z",
"host" => "0.0.0.0"
}
查看redis的监控接口上的输出
# ./redis-cli monitor
OK
1444315328.103928 [0 192.168.1.104:56211] "rpush" "logstash:redis" "{\"message\":\"dajihao linux\",\"@version\":\"1\",\"@timestamp\":\"2015-10-08T14:42:07.550Z\",\"host\":\"0.0.0.0\"}"
如果redis的监控上也有以上信息输出，表明logstash和redis的结合是正常的。
elasticsearch和logstash结合
将logstash的信息输出到elasticsearch中
# cat logstash-elasticsearch.conf
input { stdin {} }
output {
elasticsearch { host => "192.168.1.104" }
stdout { codec=> rubydebug }
}
从redis数据库中读取然后输出到elasticsearch中
# cat logstash-redis.conf
input {
redis {
host => ‘192.168.1.104‘ # 我方便测试没有指定password，最好指定password
data_type => ‘list‘
port => "6379"
key => ‘logstash:redis‘ #自定义
type => ‘redis-input‘ #自定义
}
}
output {
elasticsearch {
host => "192.168.1.104"
codec => "json"
protocol => "http" #版本1.0+ 必须指定协议http
}
}