redis和logstash配置

filebeat存入redis，logstash从redis读取数据

filebeat配置

filebeat.inputs:
- type: log
  enabled: true 
  paths:
    - /var/log/nginx/bbs_access.log
  json.keys_under_root: true
  json.overwrite_keys: true
  tags: ["bbs"]

- type: log
  enabled: true 
  paths:
    - /var/log/nginx/www_access.log
  json.keys_under_root: true
  json.overwrite_keys: true
  tags: ["www"]

setup.kibana:
  host: "10.0.0.51:5601"

output.redis:
  hosts: ["localhost"]
  keys:
    - key: "bbs"
      when.contains:
        tags: "bbs"
    - key: "www"
      when.contains:
        tags: "www"
  db: 0
  timeout: 5

setup.template.name: "nginx"
setup.template.pattern: "nginx-*"
setup.template.enabled: false
setup.template.overwrite: true

redis查看命令

redis-cli 
keys *
llen bbs
llen www

logstash配置

[root@db01 /data/soft]# cat /etc/logstash/conf.d/redis.conf 
input {
  redis {
    host => "127.0.0.1"
    port => "6379"
    db => "0"
    key => "bbs"
    data_type => "list"
  }

  redis {
    host => "127.0.0.1"
    port => "6379"
    db => "0"
    key => "www"
    data_type => "list"
  }
}

#filter {
#  mutate {
#    convert => ["upstream_time", "float"]
#    convert => ["request_time", "float"]
#  }
#}

output {
    if "bbs" in [tags] {
      stdout {} 
      elasticsearch {
        hosts => "http://10.0.0.51:9200"
        manage_template => false
        index => "nginx-bbs-%{+yyyy.MM}"
      }
    }
   
    if "www" in [tags] {
      stdout {} 
      elasticsearch {
        hosts => "http://10.0.0.51:9200"
        manage_template => false
        index => "nginx-www-%{+yyyy.MM}"
      }
    }
}

logstash启动命令

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/redis.conf