安装

1.下载https://www.elastic.co/downloads/logstash
2.上传到/usr/local目录下
3.rpm -ivh logstash.rpm
4.进入/etc/logstash目录，修改startup.options文件

Override Java location

JAVACMD="${JAVA_HOME}/bin/java"

[root@localhost logstash]# cd /usr/share/logstash/
[root@localhost logstash]# ls
bin CHANGELOG.md CONTRIBUTORS data Gemfile Gemfile.jruby-1.9.lock lib LICENSE logstash-core logstash-core-event-java logstash-core-plugin-api logstash-core-queue-jruby NOTICE.TXT vendor
[root@localhost logstash]# bin/logstash -e 'input { stdin { } } output { stdout {} }'
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs to console
17:38:21.748 [main] INFO logstash.setting.writabledirectory - Creating directory {:setting=>"path.queue", :path=>"/usr/share/logstash/data/queue"}
17:38:21.777 [LogStash::Runner] INFO logstash.agent - No persistent UUID file found. Generating new UUID {:uuid=>"bf03b281-c103-4ae0-ba01-676f50349c94", :path=>"/usr/share/logstash/data/uuid"}
The stdin plugin is now waiting for input:
17:38:22.035 [[main]-pipeline-manager] INFO logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>250}
17:38:22.052 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started
17:38:22.119 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=>9600}

[root@localhost ~]# mkdir -p /usr/share/logstash/config/
[root@localhost ~]# ln -s /etc/logstash/* /usr/share/logstash/config
[root@localhost ~]# chown -R logstash:logstash /usr/share/logstash/config/
[root@localhost ~]# cd /usr/share/logstash/
[root@localhost logstash]# ls
bin CHANGELOG.md config CONTRIBUTORS data Gemfile Gemfile.jruby-1.9.lock lib LICENSE logstash-core logstash-core-event-java logstash-core-plugin-api logstash-core-queue-jruby NOTICE.TXT vendor
[root@localhost logstash]# bin/logstash -e 'input { stdin { } } output { stdout {} }'
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
[root@localhost logstash]#