: app: logstash spec: containers: - name: logstash image: docker.elastic.co/logstash/logstash:7.15 … .container.image - stream output.logstash: hosts: ["logstash:5000"] enabled: true … 定标签 output.logstash: hosts: ["logstash:5000"] enabled:

https://artifacts.elastic.co/downloads/logstash/logstash-6.6.0.rpm 安 … 装 logstash： yum install logstash-6.6.0.rpm … ;list" key => "logstash-nginxlog" } } output { elasticsearch { hosts

档： elastic.co/guide/en/logstash/7.14/advanced-pipeline.html … ; database =>"/usr/share/logstash/GeoLite2-City.mmdb" } } output … :9200"] index => "logstash-nginx-%{+YYYY-MM-dd}"

.26 Port 9200 Logstash_Format On Logstash_Prefix fluent Logstash_DateFormat %Y.%m … } Port ${FLUENT_ELASTICSEARCH_PORT} Logstash_Format On Logstash_Prefix sit-${SERVER_NAME … Port ${FLUENT_ELASTICSEARCH_PORT} Logstash_Format On Logstash_Prefix sit-${SERVER_NAME

/plugins \ /mydata/elasticsearch/data \ /mydata/logstash \ /mydata/mysql/data/db \ /mydata … :4563 \ -v /mydata/logstash/logstash.conf:/usr/share/logstash/pipeline/logstash.conf \ -e TZ

_HOME： vim /etc/logstash/startup.options 生成logstash的systemd： /usr … /share/logstash/bin/system-install … /etc/logstash/startup.options systemd

启kibana： systemctl restart kibana logstash密码配置： 开 … 能访问包括logstash：下面的配置 … : true xpack.monitoring.elasticsearch.username: logstash_system xpack.monitoring.elasticsearch.password

9200 path "" logstash_format true logstash_prefix "k8s"

-XGET 'http://localhost:9200/logstash-2019.02.03/_search?pretty

;match nginx.*> @type elasticsearch logstash_format true host 172.31