kafka->logstash->es配置

logstash.yml

input {   
    kafka {
        bootstrap_servers => ["127.0.0.1:9092"] # 注意这里配置的kafka的broker地址不是zk的地址
        group_id => "logstash" # 自定义groupid 
        topics => ["ttp"]  # kafka topic 名称 
        consumer_threads => 5 
        decorate_events => true
        codec => "json"
        }
}
filter{
    mutate{
    add_field => { "@msg" => "%{msg}" } #先新建一个新的字段，并将friends赋值给它
    }
    json{
    source => "@msg"	#再进行解析
    remove_field => [ "@msg","msg","apiNickName" ]	#删除不必要的字段，也可以不用这语句
    }
}
output {
  elasticsearch { hosts => ["127.0.0.1:9200"] 
    index => "kafka_real"}
  stdout { codec => rubydebug } 
}

参考
https://my.oschina.net/ytqvip/blog/1795122
https://blog.csdn.net/webpetter/article/details/88535720