Logstash 同步log日志文件到Elasticsearch

雨点打透心脏的1/2处 2023-06-27 06:29 20阅读 0赞

### 1.Elasticsearch安装和Logstash安装环境参照[https://blog.csdn.net/qq\_33371766/article/details/103322707][https_blog.csdn.net_qq_33371766_article_details_103322707] ###

### 2.启动elasticsearch和kibana ###

### 3.在logstash准备同步的log和conf文件 ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2_size_16_color_FFFFFF_t_70][]![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2_size_16_color_FFFFFF_t_70 1][]

根据图示创建文件夹和文件

### 3.1 myfile.conf (根据实际情况修改path的路径和es的服务地址) ###

input {
      file {
          path =>"D:\workTool\logstash-6.3.2\myfileconfig\log_info.log"
          type=>"info_log"  #类型名称
      }
    }
    
    output {
      elasticsearch {
          hosts => ["192.168.75.1:9200"]
          index => "info_index"     #索引名称
        }
      stdout { codec => json_lines }
    }

###    3.2 info\_log.log (这里添加了3条数据，是一条一条添加的，logstash会实时的同步到es中） ###

===2019-12-16 19:25:13.361 INFO  com.zaxxer.hikari.HikariDataSource Line:110 - HikariPool-1 - Starting...  
===2019-12-16 19:33:18.582 ERROR  com.zaxxer.hikari.HikariDataSource Line:123 - HikariPool-1 - Start completed.  
===2019-10-02 22:40:15.010 WARN  org.springframework.boot.devtools.autoconfigure.OptionalLiveReloadServer Line:61  - Unable to start LiveReload server  
![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2_size_16_color_FFFFFF_t_70 2][]

### 4.验证es中的数据![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2_size_16_color_FFFFFF_t_70 3][] ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2_size_16_color_FFFFFF_t_70 4][]

数据同步成功！

es的查询语句可以参考[https://blog.csdn.net/tuntun1120/article/details/80322801][https_blog.csdn.net_tuntun1120_article_details_80322801]

[https_blog.csdn.net_qq_33371766_article_details_103322707]: https://blog.csdn.net/qq_33371766/article/details/103322707
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200105112024633.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20200105112047890.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200105112731360.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/2020010511235415.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20200105114421989.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzMzMzcxNzY2,size_16,color_FFFFFF,t_70
[https_blog.csdn.net_tuntun1120_article_details_80322801]: https://blog.csdn.net/tuntun1120/article/details/80322801