修改配置文件

将/var/log/syslog中的数据输出到elasticsearch，并以服务的方式启动

root@Logstash:~# vim /etc/logstash/conf.d/duxy6-syslog.conf
input {
  file {
    path => "/var/log/syslog"
    start_position => "beginning"
    stat_interval => 3
    type => "syslog"
  }
}

output {
  elasticsearch {
    hosts => ["192.168.1.101:9200"]
    index => "syslog-1-101-%{+YYYY.MM.dd}"
  }
}

修改/var/log/syslog的权限

root@Logstash:~# chmod 644 /var/log/syslog

root@Logstash:~# systemctl restart logstash

启动后监控日志，确保日志中没有报错

root@logstash:~# tail -f /var/log/logstash/logstash-plain.log 

在kibana中添加索引

image

image

image

在kibana上查看传递过来的系统日志信息

image