Logstash

安装

Docker

docker_name=logstash
mkdir -p /data/$docker_name/
mkdir -p /data/$docker_name/conf.d
# 主配置
# 声明子配置
echo "path.config: /usr/share/logstash/conf.d/*.conf" >> /data/$docker_name/logstash.yml
# 声明日志目录
echo "path.logs: /var/log/logstash" >> /data/$docker_name/logstash.yml
# 编辑配置文件
vi /data/$docker_name/conf.d/demo-logstash.conf
# 创建容器, 待编写好配置后运行
docker pull logstash:7.6.0
docker create --name $docker_name \
-it \
--restart=always \
-p 5044:5044 \
-p 5045:5045 \
-p 5959:5959 \
-v /data/$DOCKER_NAME/logstash.yml:/usr/share/logstash/config/logstash.yml \
-v /data/$DOCKER_NAME/conf.d/:/usr/share/logstash/conf.d/ \
-v /etc/localtime:/etc/localtime \
-d logstash:7.6.0

配置使用

基础结构

# 输入块
input {
}
# 过滤块
filter {
}
# 输出块
output {
}

常用输入块插件

->> 官方文档地址

文件

input {
    path => "/var/log/*" 
}