ELK搭建

http://blog.51cto.com/zero01/2079879

http://blog.51cto.com/zero01/2082794

下载jdk
解压安装

export JAVA_HOME=/data/app/jdk1.8.0_191
export JRE_HOME=${JAVA_HOME}/jre
export CLASSPATH=.:${JAVA_HOME}/lib:${JRE_HOME}/lib:$CLASSPATH
export JAVA_PATH=${JAVA_HOME}/bin:${JRE_HOME}/bin
export PATH=$PATH:${JAVA_PATH}

安装logstash
rpm
yum install

./logstash --path.settings /etc/logstash/ -f /etc/logstash/conf.d/classroom.conf --config.test_and_exit

input {
file { # 指定一个文件作为输入源
path => "/data/golang/src/classroom/nohup.out" # 指定文件的路径
#start_position => "beginning" # 指定何时开始收集
start_position => "end" # 指定何时开始收集
type => "golang" # 定义日志类型，可自定义
}
}
filter { # 配置过滤器
grok {
patterns_dir => ["./patterns"]
match => {
"message" => "%{REQUEST_TIME:request_time}%{KONGGE}%{INFO:log_level}%{KONGGE}%{FILES:file}%{KONGGE}%{REQ_URI:req_url}###%{KONGGE}%{BODYS:req_body}###%{BODYS:res_body}###%{NUMBER:cost_time}"
}
}
geoip {
source => "clientip"
}
}
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["10.2.1.214:9200"]
index => "classroom-rd11-%{+YYYY.MM.dd}"
}
}

REQUEST_TIME S+sS+
INFO S+
FILES S+
KONGGE s*
REQ_URI S+
BODYS [Ss]+

2018-11-14 13:13:42 info logger/logger.go:113 /teacherPc/getNoticeInfo###{}###{"data":{"info":"","type":0},"msg":"OK","statusCode":0,"success":true}###138.421