logstash 运行

Posted 2020-10-14 知子

logstash启动和配置

logstash linux下启动如下

（守护进程）

./bin/logstash agent -f conf/paycenter.conf &

logstash配置

测试服务器的写法：

业务日志文件格式如果是按天分隔:

gwp.eyimi.com_80_access_2017-07-18.log
gwp.eyimi.com_80_access_2017-07-19.log
gwp.eyimi.com_80_access_2017-07-19.log

那么在input里面使用日期格式

/data/other/nginxlogs/gwp.eyimi.com_80_access%{+YYYY.MM.dd}.log

如果是只有一个文件格式，直接使用文件的绝对路径即可！

input {
     file {
        path => "/data/other/nginx_logs/gwp.eyimi.com_80_access_%{+YYYY.MM.dd}.log"
        codec => "json"
        type => "zuolinyoujia"
    }
    //可以写多个文件，不过多个文件最终的type必须统一为一个！！！
//  file {
//        path => "/data/other/nginx_logs/nginx_error.log"
  //      codec => "json"
 //       type => "zuolinyoujia"
 //   }
}
output {
      redis {
                batch_count => 10
                data_type => "list"
                host => "10.0.9.43"
                port => 4501
                key => "%{type}"
                password => "chngalaxy2017!!!" #如果有安全认证，此项为密码
                codec => "json"
        threads => 2
    }
    }
}

　　

正式服务器的写法

（正式服务器的机器资源在申请，先内网测试走通一下看看）

input {
     file {
        path => "/data/other/nginx_logs/gwp.eyimi.com_80_access.log"
        codec => "json"
        type => "zuolinyoujia"
    }
  file {
        path => "/data/other/nginx_logs/nginx_error.log"
        codec => "json"
        type => "zuolinyoujia"
    }
}
output {
      redis {
                batch_count => 10
                data_type => "list"
                host => "192.168.0.75"
                port => 4501
                key => "%{type}"
                password => "chngalaxylog2017good!!!" #如果有安全认证，此项为密码
                codec => "json"
        threads => 2
    }
    }
}