一、logstash

版本：2.4.0

要求：Java 7 +

下载：

配置：系统java 1.6，修改bin/logstash.lib.sh文件，开头添加配置：JAVA_HOME=/usr/local/jdk1.7

数据流：file -> elasticsearch

添加输出到elasticsearch配置：es.conf

input {    file {        path => ["/home/app/log/*.log"]        codec => "line"        start_position => "end"    }}filter {    ruby {        init => "@kname = ['datetime_','website','ip'']"        code => "            new_event = LogStash::Event.new(Hash[@kname.zip(event.get('message').split('    '))])            new_event['array'] = new_event['datetime_'].split(' ')            new_event['logdate'] = new_event['array'][0] + ' ' + new_event['array'][1]            new_event['website'] = new_event['website'].split('=')[1]            new_event.remove('@timestamp')            event.append(new_event)"                    remove_field => ["datetime_","ip","array"]    }}output {    elasticsearch {        hosts => ["199.155.122.166"]        index => "log-report"    }}

 

二、elasticsearch