分享一下我老师大神的人工智能教程！零基础，通俗易懂！http://blog.csdn.net/jiangjunshow

也欢迎大家转载本篇文章。分享知识，造福人民，实现我们中华民族伟大复兴！

[[email protected] test_log]# ll-rwxrwxrwx 1 root root 170 Jul 5 08:02 logmachine.sh-rw-r--r-- 1 root root 66 Jul 5 08:25 MProbe01.log-rw-r--r-- 1 root root 74 Jul 5 08:28 MProbe02.log

[[email protected] test_log]# cat logmachine.sh#!/bin/bashicnt=0;while (true)do  echo "[debug][20160703-15:00]"$icnt >> MProbe01.log  echo "[ERROR][20160704-17:00]"$icnt >> MProbe02.log  icnt=$((icnt+1));done

[[email protected]5b9dbaaa148a logstash_jdbc_test]# cat log_test.confinput {  file {  path=> [ "/usr/local/logstash/bin/test_log/MProbe01.log","/usr/local/logstash/bin/test_log/MProbe02.log" ]  #codec=>multiline {  # pattern => "^\s"  # what=>"previous"  #}  type=>"probe_log"  #类型名称  # tags=>["XX.XX.XX.XX"]  }}###过滤#filter{# grok {# match => ["message","mailmonitor"]# add_tag => [mailmonitor]# }# grok {# match => [ "message", "smsmonitor" ]# add_tag => [smsmonitor]# }# ....#}###output to esoutput {  elasticsearch {  hosts => "10.8.5.101:9200"  index => "mprobe_index"     #索引名称  #template_name => "mprobelog"  #document_id => "%{id}"  }  stdout { codec => json_lines }}

[root@5b9dbaaa148a bin]# ./logstash -f ./logstash_jdbc_test/log_test.confSettings: Default pipeline workers: 24Pipeline main started{"message":"[DEbug][20160305-15:35]testing02","@version":"1","@timestamp":"2016-07-05T07:26:08.043Z","path":"/usr/local/logstash/bin/test_log/MProbe01.log","host":"5b9dbaaa148a"

[[email protected] test_log]# tail -f MProbe01.log[DEbug][20160305-15:35]testing02[DEbug][20160305-15:35]testing01^C[[email protected] test_log]# tail -f MProbe02.log[DEbug][20160305-15:35]testing02_001[DEbug][20160305-15:35]testing02_003

给我老师的人工智能教程打call！http://blog.csdn.net/jiangjunshow

引言：

之前博文介绍过了mysql/oracle与ES之间的同步机制。而logstash最初始的日志同步功能还没有介绍。本文就logstash同步日志到ES做下详细解读。

1、目的：

将本地磁盘存储的日志文件同步（全量同步、实时增量同步）到ES中。

2、源文件：

[[email protected] test_log]# ll-rwxrwxrwx 1 root root 170 Jul 5 08:02 logmachine.sh-rw-r--r-- 1 root root 66 Jul 5 08:25 MProbe01.log-rw-r--r-- 1 root root 74 Jul 5 08:28 MProbe02.log

• 1
• 2
• 3
• 4

3、增量实时同步脚本：

[[email protected] test_log]# cat logmachine.sh#!/bin/bashicnt=0;while (true)do  echo "[debug][20160703-15:00]"$icnt >> MProbe01.log  echo "[ERROR][20160704-17:00]"$icnt >> MProbe02.log  icnt=$((icnt+1));done

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9

4、logstash配置文件：

[[email protected]5b9dbaaa148a logstash_jdbc_test]# cat log_test.confinput {  file {  path=> [ "/usr/local/logstash/bin/test_log/MProbe01.log","/usr/local/logstash/bin/test_log/MProbe02.log" ]  #codec=>multiline {  # pattern => "^\s"  # what=>"previous"  #}  type=>"probe_log"  #类型名称  # tags=>["XX.XX.XX.XX"]  }}###过滤#filter{# grok {# match => ["message","mailmonitor"]# add_tag => [mailmonitor]# }# grok {# match => [ "message", "smsmonitor" ]# add_tag => [smsmonitor]# }# ....#}###output to esoutput {  elasticsearch {  hosts => "10.8.5.101:9200"  index => "mprobe_index"     #索引名称  #template_name => "mprobelog"  #document_id => "%{id}"  }  stdout { codec => json_lines }}

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38

5、同步测试：

[root@5b9dbaaa148a bin]# ./logstash -f ./logstash_jdbc_test/log_test.confSettings: Default pipeline workers: 24Pipeline main started{"message":"[DEbug][20160305-15:35]testing02","@version":"1","@timestamp":"2016-07-05T07:26:08.043Z","path":"/usr/local/logstash/bin/test_log/MProbe01.log","host":"5b9dbaaa148a"

• 1
• 2
• 3
• 4

6、结果验证
（1）日志记录：

[[email protected] test_log]# tail -f MProbe01.log[DEbug][20160305-15:35]testing02[DEbug][20160305-15:35]testing01^C[[email protected] test_log]# tail -f MProbe02.log[DEbug][20160305-15:35]testing02_001[DEbug][20160305-15:35]testing02_003

• 1
• 2
• 3
• 4
• 5
• 6
• 7

（2）ES记录

——————————————————————————————————
更多ES相关实战干货经验分享，请扫描下方【铭毅天下】微信公众号二维码关注。
（每周至少更新一篇！）

和你一起，死磕Elasticsearch！
——————————————————————————————————

2016年7月6日 22:11 思于家中床前

作者：铭毅天下 
转载请标明出处，原文地址：http://blog.csdn.net/laoyang360/article/details/51842744
如果感觉本文对您有帮助，请点击‘顶’支持一下，您的支持是我坚持写作最大的动力，谢谢！