上传文件至 'MD_NEW'

MD_NEW/日志中心集群.md

@@ -234,7 +234,7 @@ http.cors.allow-origin              允许的源地址。
 
 ![image-20240531101623298](https://diandiange.oss-cn-beijing.aliyuncs.com/image-20240531101623298.png)
 
-三：Kibana安装部署
+## 三：Kibana安装部署
 
 #### 1.获取包
 
@@ -249,7 +249,7 @@ http.cors.allow-origin              允许的源地址。
 
 #### 3.修改配置
 
-```
+```shell
 [root@kibana ~]# vi /usr/local/kibana/config/kibana.yml
 server.port: 5601
 server.host: "172.16.244.28"
@@ -276,27 +276,46 @@ nohup ./bin/kibana &
 
 ![image-20240603145607682](https://diandiange.oss-cn-beijing.aliyuncs.com/image-20240603145607682.png)
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+## 四：Logstash安装部署
+
+#### 1.获取包
+
+​	无
+
+#### 2.解压安装
+
+```shell
+[root@logstash ~]# tar zxvf /usr/local/package/jdk-8u121-linux-x64.tar.gz -C /usr/local/
+[root@logstash ~]# mv /usr/local/jdk-8u121 /usr/local/java
+[root@logstash ~]# vim /etc/profile
+JAVA_HOME=/usr/local/java
+PATH=$JAVA_HOME/bin:$PATH
+export JAVA_HOME PATH
+[root@logstash ~]# source /etc/profile
+[root@logstash ~]# tar xf logstash-6.5.0.tar.gz  -C /opt/
+[root@logstash ~]# mv /opt/logstash-6.5.0/ /opt/logstash
+```
+
+#### 3.使用
+
+输入输出都为终端
+
+```shell
+[root@elk-node1 ~]# /opt/logstash/bin/logstash -e 'input { stdin{} } output { stdout{} }'
+-e 后面跟搜集定义输出(input [filter] output)后面跟{}
+```
+
+输入是终端的标准输入，输出到ES集群
+
+```shell
+[root@elk-node1  ~]# /opt/logstash/bin/logstash -e 'input { stdin{} } output {  elasticsearch { hosts => ["192.168.1.160:9200"]} }'
+Settings: Default filter workers: 1
+Logstash startup completed                       #输入下面的测试数据
+123456                            
+wangshibo
+huanqiu
+hahaha
+```