修改配置文件
将/var/log/syslog中的数据输出到elasticsearch，并以服务的方式启动
root@Logstash:~# vim /etc/logstash/conf.d/duxy6-syslog.conf
input {
file {
path => "/var/log/syslog"
start_position => "beginning"
stat_interval => 3
type => "syslog"
}
}
output {
elasticsearch {
hosts => ["192.168.1.101:9200"]
index => "syslog-1-101-%{+YYYY.MM.dd}"
}
}
修改/var/log/syslog的权限
root@Logstash:~# chmod 644 /var/log/syslog
root@Logstash:~# systemctl restart logstash
启动后监控日志，确保日志中没有报错
root@logstash:~# tail -f /var/log/logstash/logstash-plain.log
在kibana中添加索引
image
image
image
在kibana上查看传递过来的系统日志信息
image
