logstash部署

1.安装java

官网推荐需要安装Java8，不支持Java9所以安装java8

[root@logstash ~]# yum install -y java-1.8.0
[root@logstash ~]# java -version
openjdk version "1.8.0_171"
OpenJDK Runtime Environment (build 1.8.0_171-b10)
OpenJDK 64-Bit Server VM (build 25.171-b10, mixed mode)

2.导入Elasticsearch PGP密钥

[root@ logstash ~]# rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

3.建立rpm包的repo

[root@ logstash ~]# vim /etc/yum.repos.d/logstash.repo 

[logstash-5.x]
name=Elastic repository for 5.x packages
baseurl=https://artifacts.elastic.co/packages/5.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

4.安装logstash

[root@logstash ~]# yum -y install logstash

5.添加配置文件logstash.conf (只是简单配置看出效果，后续更新使用)

[root@logstash ~]# cd /etc/logstash/conf.d/
[root@logstash conf.d]# vim logstash.conf   #新增配置文件logstash.conf,文件名可自己定义
input {
  kafka {
    bootstrap_servers => "192.168.205.155:9092,192.168.205.155:9092,192.168.205.155:9092"
    topics => ["credit"]            ##和filebeat配置文件对应的
#    group_id => "test-consumer-group"
#    codec => "plain"
#    consumer_threads => 1
    decorate_events => true

  }
}

output {
  elasticsearch {
    hosts => ["192.168.205.155:9200","192.168.205.156:9200","192.168.205.157:9200"]
    index => "logs-%{+YYYY.MM.dd}"
    workers => 1
  }
}

6.启动、添加开机自启

 [root@logstash ~]# systemctl start logstash
 [root@logstash ~]# systemctl enable logstash
[root@logstash ~]# systemctl status logstash
● logstash.service - logstash
   Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled)
   Active: active (running) since 四 2018-05-24 16:13:35 CST; 1min 1s ago

7.检测配置文件是否正确（出现OK正确）

[root@logstash ~]# /usr/share/logstash/bin/logstash -t --path.settings /etc/logstash/  --verbose
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
Configuration OK

自此logstash安装完毕

上一篇：filebeat+ELK+kafka集群搭建（三：kafka集群部署）
下一篇：filebeat+ELK+kafka集群搭建（五：Elasticsearch集群部署）