Logstash常见例程

谁践踏了优雅 2022-04-14 04:26 214阅读 0赞

#### 标准输入获取数据发送到屏幕 ####

[root@localhost conf.d]# cat /etc/logstash/conf.d/stdin_stdout.conf
    input{ 
        stdin {}
    } 
    
    output {
        stdout { 
            codec=>"rubydebug"
        }
    }

#### 标准输入获取数据发送到ES中 ####

[root@localhost ~]# cat  /etc/logstash/conf.d/stdin_es.conf
    input {
        stdin{} 
    } 
    output { 
        elasticsearch { 
            hosts => ["192.168.253.128:9200"] 
            index =>"test-index" 
        }
    }

#### 收集系统日志文件 ####

将日志系统日志发送到es集群与/tmp/123.txt中

[root@localhost conf.d]# cat /etc/logstash/conf.d/system.conf
    input {
    	file {
    		type => "messagelog"
    		path => "/var/log/messages"
    		start_position => "beginning"
    }}
    output {
    	file {
    		path => "/tmp/123.txt"
    }
    	elasticsearch {
    		hosts => ["192.168.253.128:9200","192.168.253.158:9200"]
    		index => "system-messages-%{+YYYY.MM.dd}"
    }}

#### 收集多个日志文件 ####

[root@localhost conf.d]#cat  /etc/logstash/conf.d/nginx.conf
    input {
    	file {
    		type => "messagelog"
    		path => "/var/log/messages"
    		start_position => "beginning"
    }
    	file {
    		type => "nginxlog"
    		path => "/var/log/nginx/access.log"
    		start_position => "beginning"
    }}
    output {
    	if [type] == "messagelog" {
    		file {
    			path => "/tmp/123.txt"
    		}
    		elasticsearch {
    			hosts => ["192.168.253.128:9200"]
    			index => "system-messages-%{+YYYY.MM.dd}"
    		}}
    	if [type] == "nginxlog" {
    		elasticsearch {
    			hosts => ["192.168.253.128:9200"]
    			index => "nginx-messages-%{+YYYY.MM.dd}"
    	}}
    }

#### 收集rsyslog日志,发送到redis中 ####

修改haproxy配置文件

log         127.0.0.1 local6 #将日志信息发送到本机的rsyslog中

修改/etc/rsyslog.conf

$ModLoad imudp
    $UDPServerRun 514
    $ModLoad imtcp
    $InputTCPServerRun 514
    local6.* @@192.168.253.158:5140 #接收日志的logstash服务器IP:PORT， local6对应haproxy的日志级别

编辑logstash配置文件

[root@localhost conf.d]# cat  /etc/logstash/conf.d/syslog.conf
    input{
    	syslog {
    		type => "system-rsyslog"
    		port => "5140"
    }}
    output{
    	stdout{
    		codec => rubydebug
    }
    	redis {
    		data_type => "list"
    		key => "haproxy-log"
    		host => "192.168.253.158"
    		port => "6379"
    		db => "0"
    		#password => "password" 如果redis有密码可以添加这一项
    }}

#### 收集tcp/udp日志,发送到redis中 ####

[root@localhost conf.d]# cat /etc/logstash/conf.d/tcp.conf
    input {
    	tcp {
    		port => “5500"
    		type => "tcp-syslog"
    		mode => "server"
    }}
    output {
    	redis {
    		data_type => "list"
    		key => "tcp-syslog"
    		host => "192.168.253.128"
    		port => "6379"
    		db => "0"
    }}

以上的例程输入输出可以任意组合，可以非常灵活