node1:elasticsearch、kibana、logstash
node2:filebeat
1、如前文,下载 logstash 6.5.0 版 安装
# rpm -ivh logstash-6.5.0-x86_64.rpm
进入配置文件目录,修改配置文件
# cd /etc/logstash/conf.d
# vim logstash.conf
[root@node1 conf.d]# cat logstash.conf input { beats { port => 5044 host => "0.0.0.0" } } filter { if [fileset][module] == "nginx" { if [fileset][name] == "access" { grok { match => { "message" => ["%{IPORHOST:remote_ip} - %{DATA:user_name} \[%{HTTPDATE:time}\] \"%{WORD:method} %{DATA:request_url} HTTP/%{NUMBER:http_version}\" %{NUMBER:response_code} %{NUMBER:body_sent_bytes} \"%{DATA:referrer_url}\" \"%{DATA:agent}\" \"%{DATA:xforward}\""] } remove_field => "message" } mutate { add_field => { "read_timestamp" => "%{@timestamp}" } } date { match => [ "time", "dd/MMM/YYYY:H:m:s Z" ] #target => "@timestamp" #remove_field => "time" } useragent { source => "agent" target => "user_agent" remove_field => "agent" } geoip { source => "remote_ip" target => "[geoip]" } } else if [fileset][name] == "error" { grok { match => { "message" => ["%{DATA:[nginx][error][time]} \[%{DATA:[nginx][error][level]}\] %{NUMBER:[nginx][error][pid]}#%{NUMBER:[nginx][error][tid]}: (\*%{NUMBER:[nginx][error][connection_id]} )?%{GREEDYDATA:[nginx][error][message]}"] } remove_field => "message" } mutate { add_field => { "read_timestamp" => "%{@timestamp}" } } date { match => [ "[nginx][error][time]", "YYYY/MM/dd H:m:s" ] #remove_field => "[nginx][error][time]" } } } } output { elasticsearch { hosts => "127.0.0.1:9200" index => "logstash-nginx-%{+YYYY-MM-dd}" } }
2,启动 logstash
查看端口,看是否启动成功
写的不好、欢迎指正:VX:85862870