ELK 6.2.2

Logstash 6.2.2启动
1、进入安装目录
cd /opt/logstash-6.2.2

2、新建first.conf
input {
beats {
port => “5044”
}
}

filter {
grok {
match => { “message” => “%{COMBINEDAPACHELOG}” }
}
geoip {
source => “172.16.10.67”
}
}

output {
elasticsearch {
hosts => [ “172.16.10.141:9200” ]
}
}

3、后台启动
./logstash -f …/first.conf

Filebeat 6.2.2启动
1、进入安装目录
/opt/filebeat-6.2.2/

2、修改filebeat.yml

paths:
- /usr/local/nginx/logs/.log
- /data/test/logs/peersfer/.log

output.logstash:
hosts: [“172.16.10.201:5044”]

3、后台启动
nohup ./filebeat -c filebeat.yml &