logstash配置文件示例

1.kafka -> es

input {  kafka {    type => "level-one"    auto_offset_reset => "smallest"    codec => plain {      charset => "GB2312"    }    group_id => "es"    topic_id => "itcast"    zk_connect => "172.16.0.11:2181,172.16.0.12:2181,172.16.0.13:2181"  }}filter {  mutate {    split => { "message" => "   " }      add_field => {        "event_type" => "%{message[3]}"        "current_map" => "%{message[4]}"        "current_X" => "%{message[5]}"        "current_y" => "%{message[6]}"        "user" => "%{message[7]}"        "item" => "%{message[8]}"        "item_id" => "%{message[9]}"        "current_time" => "%{message[12]}"     }     remove_field => [ "message" ]  } }output {    elasticsearch {      index => "level-one-%{+YYYY.MM.dd}"      codec => plain {        charset => "GB2312"      }      hosts => ["172.16.0.14:9200", "172.16.0.15:9200", "172.16.0.16:9200"]    } }

2.其他示例