After having the stand-alone experience of operating logstash, I have a general understanding of it. Not satisfied.
Then.
How to use the command line directly. It is also the way of manual input. Write the data to ES.
Just change the syntax a little . logstash -e 'input
{ stdin{} } output { elasticsearch {} }'
is as follows:
C:\Users\Administrator>D:\es\logstash-5.4.1\logstash-5.4.1\bin\logstash -e 'input
{ stdin{} } output { elasticsearch {} }'
Sending Logstash's logs to D:/es/logstash-5.4.1/logstash-5.4.1/logs which is now
configured via log4j2.properties
[2018-02- 04T05:17:38,403][INFO ][logstash.outputs.elasticsearch] Elasticsearch
pool URLs updated {:changes=>{:removed=>[], :added=>[http://127.0.0.1:9200/] }}
[2018-02-04T05:17:38,419][INFO ][logstash.outputs.elasticsearch] Running health
check to see if an Elasticsearch connection is working {:healthcheck_url=>http:/
/127.0.0.1:9200/, :path=>"/"}
[2018-02-04T05:17:38,606][WARN ][logstash.outputs.elasticsearch] Restored connec
tion to ES instance {:url=>#<URI::HTTP:0x3afb9a53 URL:http://127.0.0.1:9200/>}
[2018-02-04T05:17:38,606][INFO ][logstash.outputs.elasticsearch] Using mapping t
emplate from {:path=>nil}
[2018-02-04T05:17:38,669][INFO ][logstash.outputs.elasticsearch] Attempting to i
nstall template {:manage_template=>{"template"=>"logstash-*", "version"=>50001,
"settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"_default_"=>{"_all"=
>{"enabled"=>true, "norms"=>false}, "dynamic_templates"=>[{"message_field"=>{"pa
th_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text"
, "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"str
ing", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=
>"keyword"}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date", "include_in_all"
=>false}, "@version"=>{"type"=>"keyword", "include_in_all"=>false}, "geoip"=>{"d
ynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_po
int"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}
}}}}}
[2018-02-04T05:17:38,684][INFO ][logstash.outputs.elasticsearch] New Elasticsear elasticsearch] New Elasticsear elasticsearch] New Elasticsear
"match_all": {}
}
}
to find that a new record has finally been added.
{
"_index": "logstash-2018.02.03",
"_type": "logs",
"_id": "AWFdiFrCBZpn0eY58si-",
"_score": 1,
"_source": {
"@timestamp": "2018-02 -03T21:17:52.331Z",
"@version": "1",
"host": "iZ94hfcf8jiZ",
"message": "hello.arpenker\r"
}
}
]
}
} Sincerely
. Peugeot logstach writes data to es, and the process of querying from kibana is all open.
logstash test writes data to es
Guess you like
Origin http://43.154.161.224:23101/article/api/json?id=326078771&siteId=291194637
Recommended
Ranking