Files
obsidian_note/技术探究/logstash.md
2025-12-04 09:12:56 +08:00

98 lines
2.2 KiB
Markdown
Raw Permalink Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
### 本地文件
Sample Logstash configuration for creating a simple
```
Beats -> Logstash -> Elasticsearch pipeline.
input {
  tcp {
    port => 5000
  }
  file {
    path => "D:/projects/beijing/migu_music/migu-wiki/logs/server.log"
    start_position => beginning
    # sincedb_path => "D:\projects\beijing\migu_music\migu-wiki\logs"
    codec => multiline {
      pattern => "^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}"
      negate => true
      auto_flush_interval => 3
      what => previous
    }
  }
}
filter {
  mutate { replace => { type => "random_logs" } }
}
output {
  elasticsearch {
    hosts => "http://cqmg.860001.xyz:26017/"
    user => "elastic"
    password => "changeme"
    index=>"random_logs"
  }
  stdout { codec => rubydebug }
}
```
F:\Users\ASUS\Downloads\logstash-8.1.3-windows-x86_64\logstash-8.1.3
### 同步mysql
```
input{
stdin {
}
jdbc {
jdbc_driver_library => "/data/app/logstash-7.13.4/mysql-connector-java-5.1.47.jar"
jdbc_driver_class => "com.mysql.jdbc.Driver"
jdbc_connection_string => "jdbc:mysql://10.19.83.209:12306/dmp_dev?characterEncoding=utf8&useSSL=false"
jdbc_user => "root"
jdbc_password => "My%209admin"
jdbc_paging_enabled => "true"
jdbc_page_size => "50000"
# 设置监听间隔 各字段含义(由左至右)分、时、天、月、年,全部为*默认含>义为每分钟都更新
schedule => "* * * * * "
statement => "select * from res_terminal"
# tracking_column => "updatetime"
# 保存上一次运行>的信息(tracking_column)
# last_run_metadata_path => "./logstash_jdbc_last_run"
type => "res_terminal"
}
}
filter{
json{
source => "message"
remove_field => ["message"]
}
}
#output插件配置
output{
if[type] == "res_terminal" {
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "res_terminal"
document_type => "res_terminal"
document_id => "%{resource_id}"
}
}
#控制台打印json
stdout {
codec => json_lines
}
}
```
bin/logstash -f logstash.conf
bin/logstash -f logstash.conf -t 检测配置文件
### document_id 大小写敏感