How to configure files for Logstash

This article mainly explains "how to configure Logstash file". Friends who are interested might as well take a look. The method introduced in this paper is simple, fast and practical. Let's let the editor take you to learn how to configure Logstash files.

First, download

2. Install and start

[root@hftest0001 opt] # pwd/opt [root@hftest0001 opt] # ll...-rw- 1 root root 89916973 Jan 14 03:03 logstash-1.5.6.tar.gz... [root@hftest0001 opt] # tar-zxvf logstash-1.5.6.tar.gz [root@hftest0001 logstash-1.5.6] # pwd/opt/logstash-1.5.6 modify JAVA_ Home [root @ hftest0001 logstash-1.5.6] # vi bin/ Logstash...export JAVA_HOME=/usr/java/jdk1.7.0_67-cloudera... Add conf [root@hftest0001 logstash-1.5.6] # mkdir conf [root@hftest0001 logstash-1.5.6] # vi conf/input_file-output_file.confinput {file {path = > ["/ opt/logstash-data/input/1.log"]}} output {file {path = > ["/ opt/logstash-data/output/1.log"]}} [root@hftest0001 logstash-1.5.6] # mkdir-p / opt/logstash-data/ {input Output} [root@hftest0001 logstash-1.5.6] # touch / opt/logstash-data/input/1.log launch [root@hftest0001 logstash-1.5.6] #. / bin/logstash-f conf/ Test [root@hftest0001 logstash-1.5.6] # echo "1" > > / opt/logstash-data/input/1.log

III. Multiple configuration files

Profile segmentation. That is, divide the input,filter,output into different files.

a. One input, one output.

[root@hftest0001 logstash-1.5.6] # rm-rf. / conf/* [root@hftest0001 logstash-1.5.6] # vi conf/input_file.confinput {file {path = > ["/ opt/logstash-data/input/1.log"]}} [root@hftest0001 logstash-1.5.6] # vi conf/output_file.confoutput {file {path = > ["/ opt/logstash-data/output/1.log"] }} [root@hftest0001 logstash-1.5.6] #. / bin/logstash-f conf/ Test [root@hftest0001 logstash-1.5.6] # echo "1" > > / opt/logstash-data/input/1.log result [root@hftest0001 logstash-1.5.6] # cat / opt/logstash-data/output/1.log1

B two input (two input are exactly the same) one output

[root@hftest0001 logstash-1.5.6] # rm-rf. / conf/* [root@hftest0001 logstash-1.5.6] # vi conf/input_file.confinput {file {path = > ["/ opt/logstash-data/input/1.log"]}} [root@hftest0001 logstash-1.5.6] # vi conf/input_file2.confinput {file {path = > ["/ opt/logstash-data/input/1.log"] }} [root@hftest0001 logstash-1.5.6] # vi conf/output_file.confoutput {file {path = > ["/ opt/logstash-data/output/1.log"]}} [root@hftest0001 logstash-1.5.6] #. / bin/logstash-f conf/ Test [root@hftest0001 logstash-1.5.6] # echo "1" > > / opt/logstash-data/input/1.log Note! As a result, [root@hftest0001 logstash-1.5.6] # cat / opt/logstash-data/output/1.log1 continues to add data [root@hftest0001 logstash-1.5.6] # echo "2" > > / opt/logstash-data/input/1.log [root@hftest0001 logstash-1.5.6] # cat / opt/logstash-data/output/1.log112 = > into three pieces of data, that is, we can see that each of the two input produces a piece of data. Why aren't there two 2s? After kill logstash, [root@hftest0001 logstash-1.5.6] # cat / opt/logstash-data/output/1.log1122

C two input (two input are not the same) one output

[root@hftest0001 logstash-1.5.6] # rm-rf. / conf/* [root@hftest0001 logstash-1.5.6] # vi conf/input_file.confinput {file {path = > ["/ opt/logstash-data/input/1.log"]}} [root@hftest0001 logstash-1.5.6] # vi conf/input_file2.confinput {file {path = > ["/ opt/logstash-data/input/2.log"] }} [root@hftest0001 logstash-1.5.6] # vi conf/output_file.confoutput {file {path = > ["/ opt/logstash-data/output/1.log"]}} [root@hftest0001 logstash-1.5.6] #. / bin/logstash-f conf/ test [root@hftest0001 logstash-1.5.6] # echo "1" > > / opt/logstash-data/input/1.log result [root@hftest0001 logstash-1.5. 6] # cat / opt/logstash-data/output/1.log1 continue to add data [root@hftest0001 logstash-1.5.6] # echo "2" > > / opt/logstash-data/input/2.log [root@hftest0001 logstash-1.5.6] # cat / opt/logstash-data/output/1.log12

D one input, two output (two output are exactly the same)

[root@hftest0001 logstash-1.5.6] # rm-rf. / conf/* [root@hftest0001 logstash-1.5.6] # vi conf/input_file.confinput {file {path = > ["/ opt/logstash-data/input/1.log"]}} [root@hftest0001 logstash-1.5.6] # vi conf/output_file.confoutput {file {path = > ["/ opt/logstash-data/output/1.log"] }} [root@hftest0001 logstash-1.5.6] # vi conf/output_file2.confoutput {file {path = > ["/ opt/logstash-data/output/1.log"]}} [root@hftest0001 logstash-1.5.6] #. / bin/logstash-f conf/ Test [root@hftest0001 logstash-1.5.6] # echo "1" > > / opt/logstash-data/input/1.log Note! The result is that the same message is written to the same file by both output [root@hftest0001 logstash-1.5.6] # cat / opt/logstash-data/output/1.log11 to continue to add data [root@hftest0001 logstash-1.5.6] # echo "2" > > / opt/logstash-data/input/2.log [root@hftest0001 logstash-1.5.6] # cat / opt/logstash-data/output/1.log1122

E one input and two output (two output are different)

[root@hftest0001 logstash-1.5.6] # rm-rf. / conf/* [root@hftest0001 logstash-1.5.6] # vi conf/input_file.confinput {file {path = > ["/ opt/logstash-data/input/1.log"]}} [root@hftest0001 logstash-1.5.6] # vi conf/output_file.confoutput {file {path = > ["/ opt/logstash-data/output/1.log"] }} [root@hftest0001 logstash-1.5.6] # vi conf/output_file2.confoutput {file {path = > ["/ opt/logstash-data/output/2.log"]}} [root@hftest0001 logstash-1.5.6] #. / bin/logstash-f conf/ Test [root@hftest0001 logstash-1.5.6] # echo "1" > > / opt/logstash-data/input/1.log Note! The result is that the same message is written to different files by two output respectively [root@hftest0001 logstash-1.5.6] # cat / opt/logstash-data/output/1.log1 [root@hftest0001 logstash-1.5.6] # cat / opt/logstash-data/output/2.log1 to continue to add data [root@hftest0001 logstash-1.5.6] # echo "2" > > / opt/logstash-data/input/2.log [root@hftest0001 logstash-1.5.6 ] # cat / opt/logstash-data/output/1.log12 [root@hftest0001 logstash-1.5.6] # cat / opt/logstash-data/output/2.log12

F An Input, to be written to a different

At this point, I believe you have a deeper understanding of "how to configure Logstash file", might as well come to the actual operation of it! Here is the website, more related content can enter the relevant channels to inquire, follow us, continue to learn!