Logstash 安装说明

1. 下载文件

地址：https://artifacts.elastic.co/downloads/logstash/logstash-7.10.2-linux-x86_64.tar.gz

2. 解压文件

tar -zxvf logstash-7.10.2-linux-x86_64.tar.gz
cd logstash-7.10.2

3. 新建配置文件

vim config/logstash.conf

input {
  beats {
    port => 5044
  }
}


filter {
    # 只对springboot日志做解析其他格式，无需处理
    if [fields][file_type] == "springboot"{
      date {
              match => ["time_local", "dd/MMM/yyyy:HH:mm:ss Z"]
              target => "@timestamp"
      }
      mutate {
              split => {"message"=>"|"}
      }
      mutate {
              add_field => {
                "relative" => "%{[message][1]}"
                "thread" => "%{[message][2]}"
                "log_level" => "%{[message][3]}"
                "class" => "%{[message][4]}"
                "msg" => "%{[message][5]}"
              }
      }
      mutate {
              convert => {
                "relative" => "string"
                "thread" => "string"
                "log_level" => "string"
                "class" => "string"
                "msg" => "string"
              }
      }
      mutate {
          remove_field => ["message", "time_local"]
      }
  }
}

output {
  #stdout { codec => rubydebug }

  if [fields][file_type] == "springboot"{
    elasticsearch {
      hosts => ["http://10.0.0.28:9200"]
      index => "spring-boot-logs"
      user => "elastic"
      password => "123456"
      # 如果 es 使用的是数据量 需要指定操作类型为create
      action => "create"
    }
  }
}

4. 运行

./bin/logstash -f ./config/logstash.conf