安装部署
YUM
rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
Installing from the RPM repository
Create a file called kibana.repo in the /etc/yum.repos.d/
directory for RedHat based distributions
[kibana-5.x]name=Kibana repository for 5.x
packagesbaseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
And your repository is ready for use. You can now install Kibana with one of the following commands:
sudo yum install kibana
RPM
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.0.2.rpm
wget https://artifacts.elastic.co/downloads/kibana/kibana-5.0.2-x86_64.rpm
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.0.2.rpm
tar.gz
wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-5.0.2.tar.gz
wget https://artifacts.elastic.co/downloads/kibana/kibana-5.0.2-linux-x86_64.tar.gz
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.0.2.tar.gz
测试logstash
输入一段文字，然后检查输出
cd logstash-5.1.0
bin/logstash -e 'input { stdin { } } output { stdout {} }'
hello world
2013-11-21T01:22:14.405+0000 0.0.0.0 hello world
easy_install supervisor
echo_supervisord_conf > /etc/supervisord.conf
[program:logstash]
environment=LS_HEAP_SIZE=5000m
directory=/opt/elk/logstash
command=/opt/elk/logstash/bin/logstash -f /opt/elk/logstash/conf.d -l /opt/elk/logstash/logs
配置文件
output {
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "logstash-nginx-access-%{+YYYY.MM.dd}"
flush_size => 5000
idle_flush_time => 10
sniffing => true
}
stdout {codec => rubydebug}
}
批量发送。过去的版本中，主要由本插件的flush_size 和idle_flush_time 两个参数来控制发送数据的行为。以上面为例来说：logstash会攒到5000条数据一次性发送出去，但是如果10秒内没有攒够5000条，logstash 还是会以当前攒到的数量发送一次。
默认情况下，flush_size 是500条，idle_flush_time 是1秒。
5.0开始，有了一个前提：flush_size 的大小不能超过logstash运行时的命令行参数设置的batch_size,否则将以batch_size 为批量发送的大小。
[devlog@test config]$ curl 127.0.0.1:9200/_cat/nodes?v
ip heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name
127.0.0.1 46 98 0 0.26 0.75 0.53 mdi * HsGQJQI
更多关注：http://www.mknight.cn/
---end
