Logstash 命令

Logstash 配置

1. Logstash 配置连接 es 要用 elasticsearch （容器名称）而不是 localhost
2. 需挂载宿主机日志的目录需映射到容器目录（授予容器访问文件权限）

1input {
2# 输入源可配置 Beats Kafka Redis JDBC Syslog TCP UDP，不能定义同一个端口
3  http {
4    port => 5044
5    codec => json
6    type => "http_log"
7  }
8  file {
9    path => "/usr/share/logstash/logs/blog.log"    # 此处为容器目录
10    start_position => "beginning" # 读取文件中的所有内容，包括已经存在的内容
11    type => "blog_log"
12  }
13  file {
14    path => "/usr/share/logstash/logs/learn.log" # 此处为容器目录
15    start_position => "end"    # 只会读取文件中在启动时之后新增的内容，而不会读取文件开头的内容
16    type => "learn_log"
17  }
18}
19
20filter {
21  mutate {
22    add_field => { "[@metadata][beat]" => "your_beat_name" }
23    add_field => { "[@metadata][version]" => "1.0" }
24  }
25}
26
27output {
28  # 输出源可配置 File Kafka Redis Email HTTP InfluxDB Nagios Slack
29  elasticsearch {
30    hosts => ["http://elasticsearch:9200"]
31    index => "%{[type]}-%{+YYYY.MM.dd}"
32  }
33  stdout {
34    codec => rubydebug # 处理后的事件输出到终端
35  }
36}

1curl -X POST http://localhost:5045 -H "Content-Type: application/json" -d '{
2  "message": "This is a log message",
3  "level": "info",
4  "timestamp": "2024-11-01T15:09:41",
5  "source": "curl_command"
6}'