Centos6.5下 logstash5.2.2的安装 + log4j模式 (实践成功)

1、下载 logstash-5.2.2.tar.gz

2、解压
tar -zxvf logstash-5.2.2.tar.gz
cd logstash-5.2.2

3、修改 jvm heap 大小
/opt/logstash/logstash-5.2.2/config/jvm.options

4、创建log4j_to_es.conf，内容如下：

# For detail structure of this file
# Set: https://www.elastic.co/guide/en/logstash/current/configuration-file-structure.html
input {
  # For detail config for log4j as input,
  # See: https://www.elastic.co/guide/en/logstash/current/plugins-inputs-log4j.html
  log4j {
    mode => "server"
    host => "0.0.0.0"
    port => 4567
    type => "log4j"
  }
}
filter {
  #Only matched data are send to output.

  mutate{
    remove_field => "class"
    remove_field => "path"
    remove_field => "timestamp"
    remove_field => "@version"
  }
}
output {
  # For detail config for elasticsearch as output,
  # See: https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html
  elasticsearch {
    action => "index"                                                 #The operation on ES
    hosts  => "127.0.0.1:9200"                                   #ElasticSearch host, can be array.
    index  => "%{type}-%{+YYYY-MM-dd}"                #The index to write data to, can be any string.
  }
  stdout{
    codec => rubydebug{}
  }
}

5、后台启动运行
nohup ./logstash -f ../config/log4j_to_es.conf &