### 基礎環境部署 #### 阿里YUM源配置（略） #### 全局JDK 1.8部署 ```shell yum install java-1.8.131 ``` #### 部署logstash ```shell rpm -ivh /opt/logstash-5.5.2.rpm #logstash家目錄 /usr/share/logstash/ ``` ### 測試logstash #### 輸出到當前窗口（不推薦） ```shell /usr/share/logstash/bin/logstash -e 'input {stdin {}} output {stdout{ }}' ... 13:46:31.584 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600} ``` 輸入信息，logstash會增加時間戳后輸出 ```shell ding 2017-08-29T05:46:35.339Z web-log.prod.ding ding ``` >備注：時間戳不是東八區，瀏覽器會自動轉換 #### 輸出到文件并壓縮 ```shell /usr/share/logstash/bin/logstash -e 'input {stdin {}} output {file{path => "/tmp/logstash-test-%{+YYYY.MM.dd}.log.tar.gz" gzip => true}}' ``` 輸入后查看/tmp下的文件 #### 輸出到Elasticsearch ```shell /usr/share/logstash/bin/logstash -e 'input {stdin {}} output {elasticsearch{hosts=>["192.168.0.231:9200"] index => "logstash-test-%{+YYYY.MM.dd}"}}' ``` 輸入后查看Elasticsearch > ##### 備注：括號位置，雙引號位置，容易出錯，還需要熟悉logstash的語法