一步步建立 ELK log分析平台 --- logstash 6.5.4 安装

目录

1. 下载logstash 

2. 复制一个default.conf 文件

3.启动logstash

1. 下载logstash 

# wget https://artifacts.elastic.co/downloads/logstash/logstash-6.5.4.tar.gz

移动到安装目录解压 #tar -zxvf logstash-6.5.4.tar.gz

2. 复制一个default.conf 文件

这个配置架构里面，log是直接通过beats来收集的，没有经过Redis，后期需要的时候，再通过Redis来收集吧

#cp logstash-sample.conf default.conf

[root@iZj6c8tmr3yb0ntvym98ryZ config]# more default.conf 
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    #user => "elastic"
    #password => "changeme"
  }
}

3.启动logstash

# ./logstash -f ../config/default.conf
Sending Logstash logs to /home/admin/logstash-6.5.4/logs which is now configured via log4j2.properties
[2019-01-20T13:21:40,807][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-01-20T13:21:40,835][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.5.4"}
[2019-01-20T13:21:44,165][INFO ][logstash.pipeline        ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2019-01-20T13:21:44,776][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://localhost:9200/]}}
[2019-01-20T13:21:45,039][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"http://localhost:9200/"}
[2019-01-20T13:21:45,201][INFO ][logstash.outputs.elasticsearch] ES Output version determined {:es_version=>6}
[2019-01-20T13:21:45,205][WARN ][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>6}
[2019-01-20T13:21:45,242][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["http://localhost:9200"]}
[2019-01-20T13:21:45,283][INFO ][logstash.outputs.elasticsearch] Using mapping template from {:path=>nil}
[2019-01-20T13:21:45,330][INFO ][logstash.outputs.elasticsearch] Attempting to install template {:manage_template=>{"template"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"_default_"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}
[2019-01-20T13:21:45,508][INFO ][logstash.outputs.elasticsearch] Installing elasticsearch template to _template/logstash
[2019-01-20T13:21:45,774][INFO ][logstash.inputs.beats    ] Beats inputs: Starting input listener {:address=>"0.0.0.0:5044"}
[2019-01-20T13:21:45,968][INFO ][logstash.pipeline        ] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x4dbb075b run>"}
[2019-01-20T13:21:46,097][INFO ][org.logstash.beats.Server] Starting server on port: 5044
[2019-01-20T13:21:46,169][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2019-01-20T13:21:46,496][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}

整个系统服务器端的安装工作完成，下面我们需要做的就是在对于log服务器上安装log收集工具,beats