logstash安装

系统centos5.8

 

安装java
yum install java-1.6.0-openjdk* -y

安装elasticsearch
wget
tar -zxvf elasticsearch-0.19.11.tar.gz
mv elasticsearch-0.19.11 /usr/local/elasticsearch
/usr/local/elasticsearch/bin/elasticsearch -f

curl

安装插件elasticsearch-head:
yum install git -y
git clone git://github.com/Aconex/elasticsearch-head.git
/usr/local/elasticsearch/bin/plugin -install Aconex/elasticsearch-head
重启es

安装:logstatsh
wget

测试:
wget
修改如下:
output {
  stdout {
    debug => true
  }
  elasticsearch { embedded => true }   //开启es支持
}

安装grok:
yum install -y gcc gperf make libevent-devel pcre-devel tokyocabinet-devel
wget --no-check-certificate -O grok.tar.gz
tar zxf grok.tar.gz
cd jordansissel-grok-*
make grok
make install
ldconfig
cd ..

运行:
#java -jar logstash-1.1.5-monolithic.jar agent -f apache-parse.conf --web --backend elasticsearch:///?local
java -jar logstash-*-monolithic.jar agent -f apache-parse.conf  -- web --backend elasticsearch://localhost/

tail -f /var/log/httpd/access_log|nc 127.0.0.1 3333