一、Logstash下载
官方网站：https://www.elastic.co/cn/downloads/logstash
本文采用v7.13.2版本
wget https://artifacts.elastic.co/downloads/logstash/logstash-7.13.2-linux-x86_64.tar.gz
二、Logstash安装与配置
1.解压并移到指定目录
tar -zxvf logstash-7.13.2-linux-x86_64.tar.gz
mv logstash-7.13.2 /usr/local
2.在config目录下新建配置文件logstash.conf，如果实现logstash与springboot整合，使得springboot程序的log存储到logstash中并发送到es中，新建的配置文件可以如下:
input {
tcp {
mode => "server"
host => "0.0.0.0"
port => 4560
codec => json_lines
}
}
output {
elasticsearch {
hosts => "10.27.3.20:9200"
index => "springboot-logstash-%{+YYYY.MM.dd}"
}
}
image.png
- 给用户赋予权限 启动logstash
chown -R elkadmin. /usr/local/logstash-7.13.2/
cd /usr/local/logstash-7.13.2/bin
./logstash -f ../config/logstash.conf &
4.查看启动日志，没有报错信息表示启动成功
cd /usr/local/logstash-7.13.2/logs
image.png
查看后台进程
ps -ef|grep logstash
image.png
三、配置以systemctl方式管理Logstash
创建注册服务文件
vim /usr/lib/systemd/system/logstash.service
文件中加入以下内容
[Unit]
Description=logstash
After=network.target
[Service]
Type=simple
User=elkadmin
ExecStart=/usr/local/logstash-7.13.2/bin/logstash -f /usr/local/logstash-7.13.2/config/logstash.conf
PrivateTmp=true
[Install]
WantedBy=multi-user.target
加载配置信息
systemctl daemon-reload
设置开机启动
systemctl enable logstash.service
相关命令
# 查看服务状态
systemctl status logstash.service
# 启动服务
systemctl start logstash.service
# 重启服务
systemctl restart logstash.service
# 停止服务
systemctl stop logstash.service
# 禁止开机启动
systemctl disable logstash.service
# 启用开机启动
systemctl enable logstash.service
