一、下载
二、安装，启动
[root@hftest0001 opt]# pwd/opt[root@hftest0001 opt]# ll...-rw------- 1 root root 89916973 Jan 14 03:03 logstash-1.5.6.tar.gz...[root@hftest0001 opt]# tar -zxvf logstash-1.5.6.tar.gz[root@hftest0001 logstash-1.5.6]# pwd/opt/logstash-1.5.6修改JAVA_HOME[root@hftest0001 logstash-1.5.6]# vi bin/logstash...export JAVA_HOME=/usr/java/jdk1.7.0_67-cloudera...添加conf[root@hftest0001 logstash-1.5.6]# mkdir conf[root@hftest0001 logstash-1.5.6]# vi conf/input_file-output_file.confinput { file{ path => [ "/opt/logstash-data/input/1.log" ] }}output{ file { path => ["/opt/logstash-data/output/1.log"] }}[root@hftest0001 logstash-1.5.6]# mkdir -p /opt/logstash-data/{input,output}[root@hftest0001 logstash-1.5.6]# touch /opt/logstash-data/input/1.log启动[root@hftest0001 logstash-1.5.6]# ./bin/logstash -f conf/测试[root@hftest0001 logstash-1.5.6]# echo "1" >> /opt/logstash-data/input/1.log 三、多配置文件
配置文件分段。即把input,filter,output分成不同的文件。
A.一个input 一个output
[root@hftest0001 logstash-1.5.6]# rm -rf ./conf/*[root@hftest0001 logstash-1.5.6]# vi conf/input_file.confinput { file { path => [ "/opt/logstash-data/input/1.log" ] }}[root@hftest0001 logstash-1.5.6]# vi conf/output_file.confoutput{ file { path => ["/opt/logstash-data/output/1.log"] }}[root@hftest0001 logstash-1.5.6]# ./bin/logstash -f conf/测试[root@hftest0001 logstash-1.5.6]# echo "1" >> /opt/logstash-data/input/1.log结果[root@hftest0001 logstash-1.5.6]# cat /opt/logstash-data/output/1.log1 B 两个input(两个input是完全一样的) 一个output
[root@hftest0001 logstash-1.5.6]# rm -rf ./conf/*[root@hftest0001 logstash-1.5.6]# vi conf/input_file.confinput { file { path => [ "/opt/logstash-data/input/1.log" ] }}[root@hftest0001 logstash-1.5.6]# vi conf/input_file2.confinput { file { path => [ "/opt/logstash-data/input/1.log" ] }}[root@hftest0001 logstash-1.5.6]# vi conf/output_file.confoutput{ file { path => ["/opt/logstash-data/output/1.log"] }}[root@hftest0001 logstash-1.5.6]# ./bin/logstash -f conf/测试[root@hftest0001 logstash-1.5.6]# echo "1" >> /opt/logstash-data/input/1.log注意注意！！！！结果[root@hftest0001 logstash-1.5.6]# cat /opt/logstash-data/output/1.log1继续添加数据[root@hftest0001 logstash-1.5.6]# echo "2" >> /opt/logstash-data/input/1.log[root@hftest0001 logstash-1.5.6]# cat /opt/logstash-data/output/1.log112 =>变成了三条数据，即我们可以看出，两个input分别产生了一条数据。为什么没有两个2呢？此时kill logstash 后，[root@hftest0001 logstash-1.5.6]# cat /opt/logstash-data/output/1.log1122 C 两个input(两个input是不一样的) 一个output
[root@hftest0001 logstash-1.5.6]# rm -rf ./conf/*[root@hftest0001 logstash-1.5.6]# vi conf/input_file.confinput { file { path => [ "/opt/logstash-data/input/1.log" ] }}[root@hftest0001 logstash-1.5.6]# vi conf/input_file2.confinput { file { path => [ "/opt/logstash-data/input/2.log" ] }}[root@hftest0001 logstash-1.5.6]# vi conf/output_file.confoutput{ file { path => ["/opt/logstash-data/output/1.log"] }}[root@hftest0001 logstash-1.5.6]# ./bin/logstash -f conf/测试[root@hftest0001 logstash-1.5.6]# echo "1" >> /opt/logstash-data/input/1.log结果[root@hftest0001 logstash-1.5.6]# cat /opt/logstash-data/output/1.log1继续添加数据[root@hftest0001 logstash-1.5.6]# echo "2" >> /opt/logstash-data/input/2.log[root@hftest0001 logstash-1.5.6]# cat /opt/logstash-data/output/1.log12
D 一个input 两个output(两个output完全一样)
[root@hftest0001 logstash-1.5.6]# rm -rf ./conf/*[root@hftest0001 logstash-1.5.6]# vi conf/input_file.confinput { file { path => [ "/opt/logstash-data/input/1.log" ] }}[root@hftest0001 logstash-1.5.6]# vi conf/output_file.confoutput{ file { path => ["/opt/logstash-data/output/1.log"] }}[root@hftest0001 logstash-1.5.6]# vi conf/output_file2.confoutput{ file { path => ["/opt/logstash-data/output/1.log"] }}[root@hftest0001 logstash-1.5.6]# ./bin/logstash -f conf/测试[root@hftest0001 logstash-1.5.6]# echo "1" >> /opt/logstash-data/input/1.log注意注意！！！结果 即同一条消息被两个output都写入相同文件[root@hftest0001 logstash-1.5.6]# cat /opt/logstash-data/output/1.log11继续添加数据[root@hftest0001 logstash-1.5.6]# echo "2" >> /opt/logstash-data/input/2.log[root@hftest0001 logstash-1.5.6]# cat /opt/logstash-data/output/1.log1122 E 一个input 两个output(两个output不一样)
[root@hftest0001 logstash-1.5.6]# rm -rf ./conf/*[root@hftest0001 logstash-1.5.6]# vi conf/input_file.confinput { file { path => [ "/opt/logstash-data/input/1.log" ] }}[root@hftest0001 logstash-1.5.6]# vi conf/output_file.confoutput{ file { path => ["/opt/logstash-data/output/1.log"] }}[root@hftest0001 logstash-1.5.6]# vi conf/output_file2.confoutput{ file { path => ["/opt/logstash-data/output/2.log"] }}[root@hftest0001 logstash-1.5.6]# ./bin/logstash -f conf/测试[root@hftest0001 logstash-1.5.6]# echo "1" >> /opt/logstash-data/input/1.log注意注意！！！结果 即同一条消息分别被两个output写入不同文件[root@hftest0001 logstash-1.5.6]# cat /opt/logstash-data/output/1.log1[root@hftest0001 logstash-1.5.6]# cat /opt/logstash-data/output/2.log1继续添加数据[root@hftest0001 logstash-1.5.6]# echo "2" >> /opt/logstash-data/input/2.log[root@hftest0001 logstash-1.5.6]# cat /opt/logstash-data/output/1.log12[root@hftest0001 logstash-1.5.6]# cat /opt/logstash-data/output/2.log12 F 一个Input，要被写入不同的