Logstash

logstash.conf Dosyası

Örnek - filebeat'ten okur

Şöyle yaparız

input {
  beats {
    port => "4561"
    host => "0.0.0.0"
  }
}

filter { }

output {
  elasticsearch {
    hosts => ["0.0.0.0:9200"]
    index => "app-logs-%{+YYYY.MM.dd}"
  }
}

Örnek - stdout + elasticsearch 

Şöyle yaparız

# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  file {
    path => "<Log File Full Path>"
    start_position => "beginning"
  }
}

output {
 stdout {
    codec => rubydebug
  }
  elasticsearch {
    hosts => ["https://localhost:9200"]
    ssl_certificate_verification => false
    ssl => true
    index => "elkdemoindex"
    user => "elastic"
    password => "<Elastic Search Password>"
  }
}

Örnek - TCP'den okur

Şöyle yaparız

input {
    tcp {
        port => 4560
        codec => json_lines
    }
}

filter { }

output {
    
    elasticsearch {
        hosts  => ["http://elasticsearch:9200"]
        index  => "operationlog-%{app_name}-%{+YYYY-MM-dd}"
    }
    
}