安装Logstash

curl -L -O https://artifacts.elastic.co/downloads/logstash/logstash-7.10.1.debsudo dpkg -i logstash-7.10.1.deb

curl -L -O https://artifacts.elastic.co/downloads/logstash/logstash-7.10.1.rpmsudo rpm -i logstash-7.10.1.rpm

curl -L -O https://artifacts.elastic.co/downloads/logstash/logstash-7.10.1.tar.gztar -xzvf logstash-7.10.1.tar.gz

brew tap elastic/tapbrew install elastic/tap/logstash-full

从Logstash下载页面下载Logstash 7.10.1 Windows zip文件。将zip文件的内容解压缩到计算机上的目录，例如C\Program Files。 使用短路径（少于30个字符）以避免在Windows上遇到文件路径长度限制。

启动logstash：
cd logstash-6.2.3/bin/
sh logstash -e  'input { stdin {} } output { stdout {} }'

测试：输入hello world，然后回车，出现如下信息即为安装成功

lihuandeMacBook-Pro:bin lihuan$ sh logstash -e  'input { stdin {} } output { stdout {} }'
Using bundled JDK: /Users/lihuan/Documents/opt/elasticsearch-cluster/elasticsearch-7.10.1/logstash-7.10.1/jdk.app/Contents/Home
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.jruby.ext.openssl.SecurityHelper (file:/var/folders/s7/v42c6gpd6w5d3rh0smbw8xh80000gn/T/jruby-8117/jruby3491714406213895817jopenssl.jar) to field java.security.MessageDigest.provider
WARNING: Please consider reporting this to the maintainers of org.jruby.ext.openssl.SecurityHelper
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
Sending Logstash logs to /Users/lihuan/Documents/opt/elasticsearch-cluster/elasticsearch-7.10.1/logstash-7.10.1/logs which is now configured via log4j2.properties
[2021-01-20T20:49:41,841][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"7.10.1", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc OpenJDK 64-Bit Server VM 11.0.8+10 on 11.0.8+10 +indy +jit [darwin-x86_64]"}
[2021-01-20T20:49:42,010][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2021-01-20T20:49:42,035][INFO ][logstash.agent           ] No persistent UUID file found. Generating new UUID {:uuid=>"6004af70-cda9-4153-b77b-62bb5a8d2b7e", :path=>"/Users/lihuan/Documents/opt/elasticsearch-cluster/elasticsearch-7.10.1/logstash-7.10.1/data/uuid"}
[2021-01-20T20:49:43,006][INFO ][org.reflections.Reflections] Reflections took 31 ms to scan 1 urls, producing 23 keys and 47 values 
[2021-01-20T20:49:43,414][INFO ][logstash.javapipeline    ][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>1000, "pipeline.sources"=>["config string"], :thread=>"#<Thread:0x6203edbb run>"}
[2021-01-20T20:49:44,041][INFO ][logstash.javapipeline    ][main] Pipeline Java execution initialization time {"seconds"=>0.61}
[2021-01-20T20:49:49,078][INFO ][logstash.javapipeline    ][main] Pipeline started {"pipeline.id"=>"main"}
The stdin plugin is now waiting for input:
[2021-01-20T20:49:49,115][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2021-01-20T20:49:49,277][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}

{
    "@timestamp" => 2021-01-20T12:50:56.188Z,
          "host" => "lihuandeMacBook-Pro.local",
       "message" => "",
      "@version" => "1"
}
hello world
{
    "@timestamp" => 2021-01-20T12:51:29.605Z,
          "host" => "lihuandeMacBook-Pro.local",
       "message" => "hello world",
      "@version" => "1"
}

input {
  heartbeat {
    interval => 10
    type => "heartbeat"
  }
}
 
output {
  stdout {
    codec => rubydebug
  }
}

sh logstash -f /Users/lihuan/Documents/opt/elasticsearch-cluster/elasticsearch-7.10.1/logstash_conf/logstash.conf

{
    "type" => "heartbeat",
    "@version" => "1",
    "message" => "ok",
    "@timestamp" => 2021-01-21T03:37:44.019Z,
    "host" => "lihuandeMacBook-Pro.local"
}
{
     "type" => "heartbeat",
     "@version" => "1",
     "message" => "ok",
     "@timestamp" => 2021-01-21T03:37:54.013Z,
     "host" => "lihuandeMacBook-Pro.local"
}