03给女朋友搭建ELK-Logstash安装与配置

一、Logstash下载

官方网站：https://www.elastic.co/cn/downloads/logstash
本文采用v7.13.2版本

wget https://artifacts.elastic.co/downloads/logstash/logstash-7.13.2-linux-x86_64.tar.gz

二、Logstash安装与配置

1.解压并移到指定目录

tar -zxvf logstash-7.13.2-linux-x86_64.tar.gz

mv logstash-7.13.2 /usr/local

2.在config目录下新建配置文件logstash.conf，如果实现logstash与springboot整合，使得springboot程序的log存储到logstash中并发送到es中，新建的配置文件可以如下:

input {
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4560
    codec => json_lines
  }
}
output {
  elasticsearch {
    hosts => "10.27.3.20:9200"
    index => "springboot-logstash-%{+YYYY.MM.dd}"
  }
}

image.png

3. 给用户赋予权限 启动logstash

chown -R elkadmin. /usr/local/logstash-7.13.2/

cd /usr/local/logstash-7.13.2/bin

./logstash -f ../config/logstash.conf &

4.查看启动日志，没有报错信息表示启动成功

cd /usr/local/logstash-7.13.2/logs

image.png

查看后台进程

ps -ef|grep logstash

image.png

三、配置以systemctl方式管理Logstash

创建注册服务文件

vim /usr/lib/systemd/system/logstash.service

文件中加入以下内容

[Unit]
Description=logstash
After=network.target

[Service]
Type=simple
User=elkadmin
ExecStart=/usr/local/logstash-7.13.2/bin/logstash -f /usr/local/logstash-7.13.2/config/logstash.conf
PrivateTmp=true


[Install]
WantedBy=multi-user.target

加载配置信息

systemctl daemon-reload

设置开机启动

systemctl enable logstash.service

相关命令

# 查看服务状态
systemctl status logstash.service
# 启动服务
systemctl start logstash.service
# 重启服务
systemctl restart logstash.service
# 停止服务
systemctl stop logstash.service
# 禁止开机启动
systemctl disable logstash.service 
# 启用开机启动
systemctl enable logstash.service