logstash 安装与启动

#配置收集规则
input {
  stdin {}
}


#配置过滤规则
filter {
    grok {
        match => {
            "message" => "%{WORD} %{IP:client} %{WORD}"
        }
    }
}
#配置输出规则
output {
     elasticsearch {
                hosts => ["10.116.69.4:9200" ]
                action => "index"
                codec => rubydebug
                index => "%{type}-%{+YYYY.MM.dd}"
                template_name => "%{type}"
        }
}