简单ELK收集日志方案

实战

logstash配置

input {           #stdin {}  beats {    port => 5044  }}output {  elasticsearch {        hosts => ["192.168.126.17:9200"]        #index=>"linux-varlog-%{+YYYY.MM.dd}"        }  stdout { codec => rubydebug }}

filebeat配置

# filebeat.ymlfilebeat.prospectors:- input_type: log  paths:    - /var/log/*.log  encoding: utf-8output.logstash:  hosts: ["192.168.126.17:5044"]

elasticsearch配置

# filename : config/elasticsearch.ymlnode.name: t17path.data: ./datapath.logs: ./logsnetwork.host: 192.168.126.17http.cors.enabled: truehttp.cors.allow-origin: "*"

操作简单看