Logstash简单使用

• Logstash-控制台输入输出

cd logstash-2.4.1
bin/logstash -e 'input { stdin { } } output { stdout {} }'

Settings: Default pipeline workers: 1
Pipeline main started
hello
2018-04-10T09:11:37.888Z hadoop hello
hello
2018-04-10T09:11:41.767Z hadoop hello
word
2018-04-10T09:15:30.393Z hadoop word

Main的进程就是logstash的进程

jps
5360 Jps
5217 Main
3237 QuorumPeerMain

json形式输出到控制台

bin/logstash -e 'input { stdin { } } output { stdout {codec => json} }'

Settings: Default pipeline workers: 1
Pipeline main started

{"message":"","@version":"1","@timestamp":"2018-04-10T09:19:01.553Z","host":"hadoop"}
{"message":"","@version":"1","@timestamp":"2018-04-10T09:19:04.208Z","host":"hadoop"}hello
{"message":"hello","@version":"1","@timestamp":"2018-04-10T09:19:08.074Z","host":"hadoop"}word
{"message":"word","@version":"1","@timestamp":"2018-04-10T09:19:10.753Z","host":"hadoop"}heihei
{"message":"heihei","@version":"1","@timestamp":"2018-04-10T09:19:12.704Z","host":"hadoop"}

当然，也可以将命令行中的参数写入到配置文件

vi test.conf
文件内容：
'input { stdin { } } output { stdout {codec => json} }'

bin/logstash -f test.conf

• Logstash-文件输入控制台输出

定义配置文件vi file_stdout.conf，input中定义输入文件的路径，output输出为控制台json形式。

input
{
   file {
        path => "/home/username/app/logstash-2.4.1/test.txt"
   }

}
output{
  stdout{codec =>json }
}

配置文件启动logstash服务bin/logstash -f file_stdout.conf，在另外的窗口往测试文件里面输入内容。

$ echo "hello world" >> test.txt
$ echo "hello world gggg" >> test.txt
$ echo "hello world qqqq" >> test.txt

logstash输出如下：

Settings: Default pipeline workers: 1
Pipeline main started
{"message":"","@version":"1","@timestamp":"2018-04-10T09:55:17.885Z","path":"/home/feiyue/app/logstash-2.4.1/test.txt","host":"hadoop"}{"message":"","@version":"1","@timestamp":"2018-04-10T09:55:17.887Z","path":"/home/feiyue/app/logstash-2.4.1/test.txt","host":"hadoop"}{"message":"hello world","@version":"1","@timestamp":"2018-04-10T09:55:26.911Z","path":"/home/feiyue/app/logstash-2.4.1/test.txt","host":"hadoop"}{"message":"hello world gggg","@version":"1","@timestamp":"2018-04-10T09:55:33.922Z","path":"/home/feiyue/app/logstash-2.4.1/test.txt","host":"hadoop"}{"message":"hello world qqqq","@version":"1","@timestamp":"2018-04-10T09:55:37.931Z","path":"/home/feiyue/app/logstash-2.4.1/test.txt","host":"hadoop"}