ELK 搭建12

elasticsearch {hosts=>"localhost:9200"}
stdout {codec=>rubydebug}

[root@h102 etc]# vim logstash-file-es-simple.conf
[root@h102 etc]# cat logstash-file-es-simple.conf
input {
	stdin{}
	file {
	    type=>"syslog"
	    path=>"/var/log/messages"
	    start_position => beginning
	}
}
output {
	elasticsearch {hosts=>"localhost:9200"}
	stdout {codec=>rubydebug}
}
[root@h102 etc]# /opt/logstash/bin/logstash -f logstash-file-es-simple.conf  -t
Configuration OK
[root@h102 etc]# /opt/logstash/bin/logstash -f logstash-file-es-simple.conf  
Settings: Default filter workers: 1
Logstash startup completed
{
       "message" => "Dec 22 17:34:02 h102 rsyslogd: [origin software=\"rsyslogd\" swVersion=\"5.8.10\" x-pid=\"1693\" x-info=\"http://www.rsyslog.com\"] rsyslogd was HUPed",
      "@version" => "1",
    "@timestamp" => "2015-12-22T14:07:12.146Z",
          "host" => "h102.temp",
          "path" => "/var/log/messages",
          "type" => "syslog"
}
{
       "message" => "Dec 22 18:19:23 h102 dhclient[1624]: DHCPREQUEST on eth3 to 192.168.1.2 port 67 (xid=0x58532bb2)",
      "@version" => "1",
    "@timestamp" => "2015-12-22T14:07:12.148Z",
          "host" => "h102.temp",
          "path" => "/var/log/messages",
          "type" => "syslog"
}
{
       "message" => "Dec 22 18:19:23 h102 dhclient[1624]: DHCPACK from 192.168.1.2 (xid=0x58532bb2)",
      "@version" => "1",
    "@timestamp" => "2015-12-22T14:07:12.149Z",
          "host" => "h102.temp",
          "path" => "/var/log/messages",
          "type" => "syslog"
}
{
       "message" => "Dec 22 18:19:24 h102 dhclient[1624]: bound to 192.168.1.117 -- renewal in 3538 seconds.",
      "@version" => "1",
    "@timestamp" => "2015-12-22T14:07:12.150Z",
          "host" => "h102.temp",
          "path" => "/var/log/messages",
          "type" => "syslog"
}
{
       "message" => "Dec 22 18:27:04 h102 kernel: hrtimer: interrupt took 6428893 ns",
      "@version" => "1",
    "@timestamp" => "2015-12-22T14:07:12.150Z",
          "host" => "h102.temp",
          "path" => "/var/log/messages",
          "type" => "syslog"
}
{
       "message" => "Dec 22 19:18:22 h102 dhclient[1624]: DHCPREQUEST on eth3 to 192.168.1.2 port 67 (xid=0x58532bb2)",
      "@version" => "1",
    "@timestamp" => "2015-12-22T14:07:12.151Z",
          "host" => "h102.temp",
          "path" => "/var/log/messages",
          "type" => "syslog"
}
...
...
{
       "message" => "Dec 22 21:51:56 h102 dhclient[1624]: DHCPACK from 192.168.1.2 (xid=0x58532bb2)",
      "@version" => "1",
    "@timestamp" => "2015-12-22T14:07:12.188Z",
          "host" => "h102.temp",
          "path" => "/var/log/messages",
          "type" => "syslog"
}
{
       "message" => "Dec 22 21:51:57 h102 dhclient[1624]: bound to 192.168.1.117 -- renewal in 2973 seconds.",
      "@version" => "1",
    "@timestamp" => "2015-12-22T14:07:12.203Z",
          "host" => "h102.temp",
          "path" => "/var/log/messages",
          "type" => "syslog"
}
abc
{
       "message" => "abc",
      "@version" => "1",
    "@timestamp" => "2015-12-22T14:11:19.994Z",
          "host" => "h102.temp"
}
xyz
{
       "message" => "xyz",
      "@version" => "1",
    "@timestamp" => "2015-12-22T14:11:22.893Z",
          "host" => "h102.temp"
}
def
{
       "message" => "def",
      "@version" => "1",
    "@timestamp" => "2015-12-22T14:11:25.633Z",
          "host" => "h102.temp"
}
...
...