{"id":41128,"date":"2023-04-29T04:48:02","date_gmt":"2023-11-22T23:03:19","guid":{"rendered":"https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/"},"modified":"2024-04-30T01:48:17","modified_gmt":"2024-04-29T17:48:17","slug":"%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/","title":{"rendered":"\u8bb0\u5f55\u4e0b\u5c06346\u4e07\u6761\u8bbf\u95ee\u65e5\u5fd7\u901a\u8fc7Logstash\u53d1\u9001\u5230Elasticsearch\u7684\u65f6\u95f4"},"content":{"rendered":"<h1>\u9996\u5148<\/h1>\n<p>\u53ea\u662f\u4e3a\u4e86\u5728\u7a0d\u540e\u4f7f\u7528Kibana\u73a9\u800d\uff0c\u6211\u4eec\u540c\u65f6\u4f7f\u7528Logstash\u5c06\u6570\u636e\u6295\u5165Elasticsearch\u4e2d\uff0c\u51fa\u4e8e\u597d\u5947\u5fc3\u60f3\u8981\u786e\u8ba4\u4e00\u4e0b\u80fd\u591f\u4ee5\u591a\u5feb\u7684\u901f\u5ea6\u6295\u5165\u591a\u5c11\u6570\u636e\u3002\u987a\u4fbf\u63d0\u4e00\u4e0b\uff0c\u6211\u4eec\u7684\u7ed3\u8bba\u662f\u5728\u5927\u7ea623\u5206\u949f\u5185\u5b8c\u6210\u3002<\/p>\n<h1>\u8fd0\u884c\u73af\u5883<\/h1>\n<p>\u5728Mac\u4e0a\u5b89\u88c5Docker\uff0c\u5e76\u5728\u5176\u4e0a\u901a\u8fc7\u5bb9\u5668\u8fd0\u884cLogstash\u548cElasticsearch\u3002<\/p>\n<ul class=\"post-ul\">\n<li style=\"list-style-type: none;\">\n<ul class=\"post-ul\">PC<\/ul>\n<\/li>\n<\/ul>\n<p>MacBook Air (13-inch, Early 2015)<br \/>\nmacOS High Sierra \u30d0\u30fc\u30b8\u30e7\u30f3 10.13.3<br \/>\n\u30d7\u30ed\u30bb\u30c3\u30b5 1.6 GHz Intel Core i5<br \/>\n\u30e1\u30e2\u30ea 8 GB 1600 MHz DDR3<\/p>\n<p>Docker Version 18.03.0-ce-mac59 (23608)<br \/>\nElasticsearch 6.2.3<br \/>\nLogstash 6.2.3<\/p>\n<h1>\u5b89\u88c5 Elasticsearch 6.2.3\u3002<\/h1>\n<p>\u7531\u4e8e\u6211\u4e4b\u524d\u4f7f\u7528\u7684\u4e1c\u897f\u5df2\u7ecf\u6709\u70b9\u8001\u65e7\u4e86\uff0c\u6240\u4ee5\u5728\u8fdb\u884c\u5de5\u4f5c\u65f6\u62ff\u5230\u4e86\u6700\u65b0\u7684\u8bbe\u5907\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">$<\/span> docker pull docker.elastic.co\/elasticsearch\/elasticsearch:6.2.3\r\n<\/code><\/pre>\n<p>\u5728\u6267\u884c\u5bb9\u5668\u4e4b\u524d\uff0c\u6839\u636e\u83b7\u53d6\u7684\u6620\u50cf\u6765\u521b\u5efa\u7f51\u7edc\u4ee5\u8fde\u63a5Elasticsearch\u3001Logstash\u548cKibana\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">$<\/span> docker network create elasticnw\r\n<\/code><\/pre>\n<p>\u5728\u521b\u5efa\u7684\u7f51\u7edc\u4e0a\u6302\u8f7d\u5bb9\u5668\u2014\u2014\u901a\u8fc7\u6dfb\u52a0&#8211;net\u9009\u9879\u6765\u8fd0\u884c\u5bb9\u5668\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">$<\/span> docker run <span class=\"nt\">-dti<\/span> <span class=\"nt\">-h<\/span> elasticsearch <span class=\"nt\">--name<\/span> elasticsearch <span class=\"nt\">-p<\/span> 9200:9200 <span class=\"nt\">-p<\/span> 9300:9300 <span class=\"nt\">-e<\/span> <span class=\"s2\">\"discovery.type=single-node\"<\/span> <span class=\"nt\">--net<\/span> elasticnw docker.elastic.co\/elasticsearch\/elasticsearch:6.2.3 \/bin\/bash\r\n<\/code><\/pre>\n<p>Elasticsearch\u7684\u5bb9\u5668\u9ed8\u8ba4\u4ee5root\u7528\u6237\u9644\u52a0\u8fdb\u5165\uff0c\u4f46\u65e0\u6cd5\u4ee5root\u7528\u6237\u6267\u884cElasticsearch\uff0c\u8fd8\u6709\u4e00\u4e2a\u8bbe\u4e86\u9677\u9631\u7684\u7b80\u6613\u542f\u52a8\u811a\u672c\u9700\u8981\u624b\u52a8\u8f93\u5165\u542f\u52a8\u547d\u4ee4\uff0c\u8fd9\u5f88\u9ebb\u70e6\u3002\u4e3a\u4e86\u65b9\u4fbf\uff0c\u6211\u521b\u5efa\u4e86\u4e00\u4e2a\u7b80\u5355\u7684\u542f\u52a8\u811a\u672c\u5e76\u5c06\u5176\u653e\u7f6e\u5728elasticsearch\\bin\u7684\u8def\u5f84\u4e0b\uff0c\u867d\u7136\u6709\u4e9b\u7c97\u66b4\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c\">#!\/bin\/bash<\/span>\r\n\r\n<span class=\"c\">#--------------------------------------------------<\/span>\r\n<span class=\"c\"># elasticsearch startup shell<\/span>\r\n<span class=\"c\">#--------------------------------------------------<\/span>\r\n\r\n<span class=\"nv\">ELASTIC_HOME<\/span><span class=\"o\">=<\/span><span class=\"s2\">\"\/usr\/share\/elasticsearch\"<\/span>\r\n\r\nsu - elasticsearch <span class=\"nt\">-c<\/span> <span class=\"nv\">$ELASTIC_HOME<\/span>\/bin\/elasticsearch <span class=\"o\">&gt;<\/span> <span class=\"nv\">$ELASTIC_HOME<\/span>\/logs\/elastic.log &amp;\r\n\r\n<\/code><\/pre>\n<p>\u5f53\u542f\u52a8\u65e5\u5fd7\u7a33\u5b9a\u540e\uff0c\u901a\u8fc7\u4e3b\u673a\u64cd\u4f5c\u7cfb\u7edf\u8fdb\u884c\u8fde\u901a\u786e\u8ba4\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">$<\/span> curl <span class=\"nt\">-s<\/span> http:\/\/localhost:9200\r\n<span class=\"go\">{\r\n  \"name\" : \"pBmvODk\",\r\n  \"cluster_name\" : \"docker-cluster\",\r\n  \"cluster_uuid\" : \"7QL3pMI6T2SLyxc22KdYxg\",\r\n  \"version\" : {\r\n    \"number\" : \"6.2.3\",\r\n    \"build_hash\" : \"c59ff00\",\r\n    \"build_date\" : \"2018-03-13T10:06:29.741383Z\",\r\n    \"build_snapshot\" : false,\r\n    \"lucene_version\" : \"7.2.1\",\r\n    \"minimum_wire_compatibility_version\" : \"5.6.0\",\r\n    \"minimum_index_compatibility_version\" : \"5.0.0\"\r\n  },\r\n  \"tagline\" : \"You Know, for Search\"\r\n}\r\n<\/span><\/code><\/pre>\n<p>\u901a\u4fe1\u826f\u597d\u3002\u63a5\u4e0b\u6765\u662fLogstash\u3002<\/p>\n<h1>\u5b89\u88c5Logstash<\/h1>\n<p>\u901a\u8fc7\u4f7f\u7528\u5bb9\u5668\u6765\u5b89\u88c5Logstash\u3002\u4f7f\u7528-v\u9009\u9879\u5c06\u4e3b\u673a\u64cd\u4f5c\u7cfb\u7edf\u7684\u76ee\u5f55\u6302\u8f7d\u5230\u5bb9\u5668\u4e2d\uff0c\u4f7f\u7528&#8211;net\u9009\u9879\u5c06\u5176\u8fde\u63a5\u5230Elasticsearch\u76f8\u540c\u7684\u7f51\u7edc\u4e2d\u3002\u542f\u52a8\u5bb9\u5668\u540e\uff0c\u9644\u52a0\u5e76\u8fdb\u5165\u5bb9\u5668\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">$<\/span> docker pull docker.elastic.co\/logstash\/logstash:6.2.3\r\n<span class=\"gp\">$<\/span> docker run <span class=\"nt\">-dti<\/span> <span class=\"nt\">-h<\/span> logstash <span class=\"nt\">--name<\/span> logstash <span class=\"nt\">-v<\/span> \/work\/data\/logstash:\/data <span class=\"nt\">--net<\/span> elasticnw docker.elastic.co\/logstash\/logstash:6.2.3 \/bin\/bash\r\n<span class=\"gp\">$<\/span> docker attach logstash\r\n<\/code><\/pre>\n<p>\u7531\u4e8e\u8fd9\u6b21\u5904\u7406\u7684\u6570\u636e\u662f Apache HTTP Server \u7684\u5e38\u89c1\u683c\u5f0f\u7684 accesslog\uff0c\u6240\u4ee5\u9700\u8981\u521b\u5efa\u4ee5\u4e0b\u7684 conf \u6587\u4ef6\u3002\u5148\u5c06\u5b83\u653e\u7f6e\u5728 Logstash \u7684\u4e3b\u76ee\u5f55\u4e0b\u7684 config \u6587\u4ef6\u5939\u4e2d\u3002\u4e3a\u4ec0\u4e48\u7d22\u5f15\u540d\u79f0\u662f nasa \u5462\uff1f\u56e0\u4e3a\u5728\u7f51\u4e0a\u5bfb\u627e\u5927\u91cf\u65e5\u5fd7\u6570\u636e\u7684\u6837\u672c\u65f6\uff0c\u6211\u53d1\u73b0\u4e86NASA\u57281995\u5e747\u6708\u548c8\u6708\u53d1\u5e03\u7684\u5173\u4e8e\u5176WWW\u7f51\u7ad9\u8bbf\u95ee\u65e5\u5fd7\u7684\u5386\u53f2\u6570\u636e\uff0c\u6240\u4ee5\u6211\u9009\u62e9\u4f7f\u7528\u4e86\u8fd9\u4e9b\u6570\u636e\u3002\u8fd9\u4e2a\u539f\u56e0\u5c31\u85cf\u5728\u8fd9\u91cc\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"n\">input<\/span> {\r\n  <span class=\"n\">file<\/span> {\r\n    <span class=\"n\">path<\/span> =&gt; <span class=\"s2\">\"\/data\/access_log_*\"<\/span>\r\n    <span class=\"n\">start_position<\/span> =&gt; <span class=\"s2\">\"beginning\"<\/span>\r\n    <span class=\"n\">sincedb_path<\/span> =&gt; <span class=\"s2\">\"\/dev\/null\"<\/span>\r\n  }\r\n}\r\n\r\n<span class=\"n\">filter<\/span> {\r\n  <span class=\"n\">if<\/span> [<span class=\"n\">path<\/span>] =~ <span class=\"s2\">\"access\"<\/span> {\r\n    <span class=\"n\">mutate<\/span> { <span class=\"n\">replace<\/span> =&gt; { <span class=\"s2\">\"type\"<\/span> =&gt; <span class=\"s2\">\"apache_access\"<\/span> } }\r\n    <span class=\"n\">grok<\/span> {\r\n      <span class=\"n\">match<\/span> =&gt; { <span class=\"s2\">\"message\"<\/span> =&gt; <span class=\"s2\">\"%{COMMONAPACHELOG}\"<\/span> }\r\n    }\r\n  }\r\n  <span class=\"n\">date<\/span> {\r\n    <span class=\"n\">match<\/span> =&gt; [ <span class=\"s2\">\"timestamp\"<\/span> , <span class=\"s2\">\"dd\/MMM\/yyyy:HH:mm:ss Z\"<\/span> ]\r\n  }\r\n}\r\n\r\n<span class=\"n\">output<\/span> {\r\n    <span class=\"n\">elasticsearch<\/span> {\r\n        <span class=\"n\">hosts<\/span> =&gt; [ <span class=\"s2\">\"elasticsearch\"<\/span> ]\r\n        <span class=\"n\">index<\/span> =&gt; <span class=\"s2\">\"nasa\"<\/span>\r\n    }\r\n}\r\n<\/code><\/pre>\n<p>\u5c06\u4e0b\u8f7d\u7684\u6570\u636e\u653e\u7f6e\u5728\u4e3b\u673a\u64cd\u4f5c\u7cfb\u7edf\u7684\u6570\u636e\u6587\u4ef6\u5939\u4e2d\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">$<\/span> <span class=\"nb\">mv<\/span> ~\/Downloads\/access_log_<span class=\"k\">*<\/span>95 \/work\/data\/logstash\r\n<span class=\"gp\">$<\/span> <span class=\"nb\">cd<\/span> \/work\/data\/logstash\r\n<span class=\"gp\">$<\/span> <span class=\"nb\">ls<\/span> <span class=\"nt\">-l<\/span>\r\n<span class=\"go\">-rw-r--r--@ 1 xxxx@xxxx  staff  167813770  4 16 17:18 access_log_Aug95\r\n-rw-r--r--@ 1 xxxx@xxxx  staff  205242368  4 16 17:17 access_log_Jul95\r\n<\/span><\/code><\/pre>\n<p>\u5728\u5bb9\u5668\u5185\u4e5f\u8fdb\u884c\u786e\u8ba4\uff0c\u786e\u5b9e\u5b58\u5728\u3002\u603b\u5171\u7ea6\u6709346\u4e07\u884c\u3002\u6587\u4ef6\u7684\u65f6\u95f4\u5fae\u5999\u5730\u504f\u79bb\u662f\u56e0\u4e3a\u5bb9\u5668\u7684\u65f6\u95f4\u4ecd\u7136\u662fUTC\u65f6\u95f4\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">bash-4.2$<\/span> <span class=\"nb\">ls<\/span> <span class=\"nt\">-l<\/span> \/data\r\n<span class=\"go\">total 364316\r\n-rw-r--r-- 1 logstash logstash 167813770 Apr 16 08:18 access_log_Aug95\r\n-rw-r--r-- 1 logstash logstash 205242368 Apr 16 08:17 access_log_Jul95\r\n<\/span><span class=\"gp\">bash-4.2$<\/span> <span class=\"nb\">wc<\/span> <span class=\"nt\">-l<\/span> access_log_<span class=\"k\">*<\/span>\r\n<span class=\"go\">  1569898 access_log_Aug95\r\n  1891714 access_log_Jul95\r\n  3461612 total\r\n<\/span><\/code><\/pre>\n<p>\u4ee5\u4e0a\u662f\u51c6\u5907\u65e5\u5fd7\u6240\u9700\u7684\u5168\u90e8\u6b65\u9aa4\u3002<\/p>\n<h1>\u51c6\u5907\u7b80\u6613\u6d4b\u91cf\u811a\u672c\u3002<\/h1>\n<p>\u6211\u89c9\u5f97\u53ef\u80fd\u8fd8\u6709\u66f4\u597d\u7684\u65b9\u6cd5\uff0c\u4f46\u662f\u53ef\u4ee5\u521b\u5efa\u4e00\u4e2a\u811a\u672c\uff0c\u6bcf\u79d2\u5411Elasticsearch\u7d22\u5f15\u5185\u7684\u6587\u6863\u6570\u53d1\u51fa\u67e5\u8be2\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"c\">#!\/bin\/sh<\/span>\r\n\r\n<span class=\"nv\">ESURL<\/span><span class=\"o\">=<\/span><span class=\"s2\">\"http:\/\/localhost:9200\"<\/span>\r\n\r\n<span class=\"k\">if<\/span> <span class=\"o\">[<\/span> <span class=\"nv\">$# <\/span><span class=\"o\">==<\/span> 0 <span class=\"o\">]<\/span>\r\n<span class=\"k\">then\r\n  <\/span><span class=\"nb\">echo\r\n  echo<\/span> <span class=\"s2\">\"usage: <\/span><span class=\"nv\">$0<\/span><span class=\"s2\"> INDEX\"<\/span>\r\n  <span class=\"nb\">echo\r\n  exit <\/span>1\r\n<span class=\"k\">else\r\n  <\/span><span class=\"nv\">INDEX_NAME<\/span><span class=\"o\">=<\/span><span class=\"nv\">$1<\/span>\r\n<span class=\"k\">fi\r\n\r\nwhile <\/span><span class=\"nb\">true\r\n<\/span><span class=\"k\">do\r\n  <\/span><span class=\"nb\">echo<\/span> <span class=\"sb\">`<\/span><span class=\"nb\">date<\/span> +[%Y\/%m\/%d<span class=\"s2\">\" \"<\/span>%T]<span class=\"sb\">`<\/span> <span class=\"sb\">`<\/span>curl <span class=\"nt\">-s<\/span> <span class=\"nv\">$ESURL<\/span>\/<span class=\"nv\">$INDEX_NAME<\/span>\/_count<span class=\"sb\">`<\/span>\r\n  <span class=\"nb\">sleep <\/span>1\r\n<span class=\"k\">done\r\n\r\n<\/span><span class=\"nb\">exit <\/span>0\r\n\r\n<\/code><\/pre>\n<p>\u522b\u5fd8\u8bb0\u8bbe\u7f6e\u6743\u9650\u3002<\/p>\n<pre class=\"post-pre\"><code>$ chmod 755 countesdocs.sh\r\n<\/code><\/pre>\n<h1>\u6267\u884c\u6d4b\u91cf<\/h1>\n<p>\u540c\u65f6\u8fd0\u884cLogstash\u548c\u8ba1\u91cf\u811a\u672c\u3002\u8ba1\u91cf\u811a\u672c\u5728\u4e3b\u673a\u64cd\u4f5c\u7cfb\u7edf\u4e0a\u6267\u884c\uff0c\u901a\u8fc7tail\u547d\u4ee4\u67e5\u770b\u8f93\u51fa\u65e5\u5fd7\u3002<\/p>\n<pre class=\"post-pre\"><code><span class=\"gp\">bash-4.2$<\/span> logstash <span class=\"nt\">-f<\/span> \/usr\/share\/logstash\/config\/accesslog.conf \r\n<\/code><\/pre>\n<pre class=\"post-pre\"><code><span class=\"gp\">$<\/span> .\/countesdocs.sh nasa <span class=\"o\">&gt;<\/span> logstash_nasa.log &amp;\r\n<span class=\"gp\">$<\/span> <span class=\"nb\">tail<\/span> <span class=\"nt\">-f<\/span> logstash_nasa.log\r\n<\/code><\/pre>\n<p>\u5927\u7ea6\u5728\u6267\u884c Logstash \u540e\u76841\u5206\u949f\u540e\u5f00\u59cb\u8f93\u5165\u6570\u636e\u3002<\/p>\n<pre class=\"post-pre\"><code>[2018\/04\/17 10:50:27] {\"error\":{\"root_cause\":[{\"type\":\"index_not_found_exception\",\"reason\":\"no such index\",\"resource.type\":\"index_or_alias\",\"resource.id\":\"nasa\",\"index_uuid\":\"_na_\",\"index\":\"nasa\"}],\"type\":\"index_not_found_exception\",\"reason\":\"no such index\",\"resource.type\":\"index_or_alias\",\"resource.id\":\"nasa\",\"index_uuid\":\"_na_\",\"index\":\"nasa\"},\"status\":404}\r\n[2018\/04\/17 10:50:28] {\"error\":{\"root_cause\":[{\"type\":\"index_not_found_exception\",\"reason\":\"no such index\",\"resource.type\":\"index_or_alias\",\"resource.id\":\"nasa\",\"index_uuid\":\"_na_\",\"index\":\"nasa\"}],\"type\":\"index_not_found_exception\",\"reason\":\"no such index\",\"resource.type\":\"index_or_alias\",\"resource.id\":\"nasa\",\"index_uuid\":\"_na_\",\"index\":\"nasa\"},\"status\":404}\r\n[2018\/04\/17 10:50:29] {\"error\":{\"root_cause\":[{\"type\":\"index_not_found_exception\",\"reason\":\"no such index\",\"resource.type\":\"index_or_alias\",\"resource.id\":\"nasa\",\"index_uuid\":\"_na_\",\"index\":\"nasa\"}],\"type\":\"index_not_found_exception\",\"reason\":\"no such index\",\"resource.type\":\"index_or_alias\",\"resource.id\":\"nasa\",\"index_uuid\":\"_na_\",\"index\":\"nasa\"},\"status\":404}\r\n\r\n--- \u4e2d\u7565 ---\r\n\r\n[2018\/04\/17 10:51:29] {\"error\":{\"root_cause\":[{\"type\":\"index_not_found_exception\",\"reason\":\"no such index\",\"resource.type\":\"index_or_alias\",\"resource.id\":\"nasa\",\"index_uuid\":\"_na_\",\"index\":\"nasa\"}],\"type\":\"index_not_found_exception\",\"reason\":\"no such index\",\"resource.type\":\"index_or_alias\",\"resource.id\":\"nasa\",\"index_uuid\":\"_na_\",\"index\":\"nasa\"},\"status\":404}\r\n[2018\/04\/17 10:51:30] {\"count\":0,\"_shards\":{\"total\":5,\"successful\":4,\"skipped\":0,\"failed\":0}}\r\n[2018\/04\/17 10:51:31] {\"count\":668,\"_shards\":{\"total\":5,\"successful\":5,\"skipped\":0,\"failed\":0}}\r\n\r\n<\/code><\/pre>\n<p>\u6839\u636e\u5f00\u5934\u7684\u8bb0\u5f55\uff0c\u4ece10:50:27\u5f00\u59cb\u5230\u5927\u7ea623\u5206\u949f\u540e\u5b8c\u6210\u4e86\u6295\u5165\uff0811:12:52\uff09\u3002\u867d\u7136\u6ca1\u6709\u5b8c\u5168\u7edf\u8ba1\uff0c\u4f46\u6bcf\u79d2\u5927\u7ea6\u53ef\u4ee5\u6295\u51652000\u81f34000\u6761\u6570\u636e\u3002\u867d\u7136\u6ca1\u6709\u76d1\u63a7CPU\u548c\u5185\u5b58\uff0c\u4f46\u5bf9\u4e8e\u8fd9\u79cd\u7a0b\u5ea6\u7684Mac\u6765\u8bf4\u5e94\u8be5\u5e94\u4ed8\u5f97\u4e86\u5427\u3002<\/p>\n<pre class=\"post-pre\"><code>[2018\/04\/17 11:12:50] {\"count\":3454294,\"_shards\":{\"total\":5,\"successful\":5,\"skipped\":0,\"failed\":0}}\r\n[2018\/04\/17 11:12:51] {\"count\":3458432,\"_shards\":{\"total\":5,\"successful\":5,\"skipped\":0,\"failed\":0}}\r\n[2018\/04\/17 11:12:52] {\"count\":3461612,\"_shards\":{\"total\":5,\"successful\":5,\"skipped\":0,\"failed\":0}}\r\n[2018\/04\/17 11:12:53] {\"count\":3461612,\"_shards\":{\"total\":5,\"successful\":5,\"skipped\":0,\"failed\":0}}\r\n[2018\/04\/17 11:12:54] {\"count\":3461612,\"_shards\":{\"total\":5,\"successful\":5,\"skipped\":0,\"failed\":0}}\r\n\r\n<\/code><\/pre>\n<p>\u5982\u679c\u6709\u4e00\u4e2a\u826f\u597d\u7684\u670d\u52a1\u5668\u6216\u96c6\u7fa4\u67b6\u6784\uff0c\u6027\u80fd\u5e94\u8be5\u4f1a\u66f4\u597d\u3002\u6211\u60f3\u662f\u8fd9\u6837\u7684\u3002<\/p>\n<h1>\u8bf7\u770b\u8fd9\u4e2a\u3002<\/h1>\n<p>\u4f7f\u7528Logstash\u5c06Apache\u65e5\u5fd7\u8f93\u5165\u5230Elasticsearch\u7684\u65b9\u6cd5<br \/>\nLogstash\u914d\u7f6e\u793a\u4f8b<br \/>\n\u4f7f\u7528Docker\u5b89\u88c5Elasticsearch<br \/>\n\u641c\u7d22API<br \/>\n\u516c\u5f00\u53ef\u8bbf\u95ee\u7684access.log\u6570\u636e\u96c6<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u9996\u5148 \u53ea\u662f\u4e3a\u4e86\u5728\u7a0d\u540e\u4f7f\u7528Kibana\u73a9\u800d\uff0c\u6211\u4eec\u540c\u65f6\u4f7f\u7528Logstash\u5c06\u6570\u636e\u6295\u5165Elasticsearch\u4e2d\uff0c [&hellip;]<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-41128","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.5 (Yoast SEO v21.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u8bb0\u5f55\u4e0b\u5c06346\u4e07\u6761\u8bbf\u95ee\u65e5\u5fd7\u901a\u8fc7Logstash\u53d1\u9001\u5230Elasticsearch\u7684\u65f6\u95f4 - Blog - Silicon Cloud<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/zh\/blog\/\u8bb0\u5f55\u4e0b\u5c06346\u4e07\u6761\u8bbf\u95ee\u65e5\u5fd7\u901a\u8fc7logstash\u53d1\u9001\u5230elasticsearch\u7684\u65f6\u95f4\u3002\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u8bb0\u5f55\u4e0b\u5c06346\u4e07\u6761\u8bbf\u95ee\u65e5\u5fd7\u901a\u8fc7Logstash\u53d1\u9001\u5230Elasticsearch\u7684\u65f6\u95f4\" \/>\n<meta property=\"og:description\" content=\"\u9996\u5148 \u53ea\u662f\u4e3a\u4e86\u5728\u7a0d\u540e\u4f7f\u7528Kibana\u73a9\u800d\uff0c\u6211\u4eec\u540c\u65f6\u4f7f\u7528Logstash\u5c06\u6570\u636e\u6295\u5165Elasticsearch\u4e2d\uff0c [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/zh\/blog\/\u8bb0\u5f55\u4e0b\u5c06346\u4e07\u6761\u8bbf\u95ee\u65e5\u5fd7\u901a\u8fc7logstash\u53d1\u9001\u5230elasticsearch\u7684\u65f6\u95f4\u3002\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2023-11-22T23:03:19+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-29T17:48:17+00:00\" \/>\n<meta name=\"author\" content=\"\u6e05, \u626c\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u6e05, \u626c\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/\",\"name\":\"\u8bb0\u5f55\u4e0b\u5c06346\u4e07\u6761\u8bbf\u95ee\u65e5\u5fd7\u901a\u8fc7Logstash\u53d1\u9001\u5230Elasticsearch\u7684\u65f6\u95f4 - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\"},\"datePublished\":\"2023-11-22T23:03:19+00:00\",\"dateModified\":\"2024-04-29T17:48:17+00:00\",\"author\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.silicloud.com\/zh\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u8bb0\u5f55\u4e0b\u5c06346\u4e07\u6761\u8bbf\u95ee\u65e5\u5fd7\u901a\u8fc7Logstash\u53d1\u9001\u5230Elasticsearch\u7684\u65f6\u95f4\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/\",\"name\":\"Blog - Silicon Cloud\",\"description\":\"\",\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461\",\"name\":\"\u6e05, \u626c\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g\",\"caption\":\"\u6e05, \u626c\"},\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/author\/qingyang\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Blog - Silicon Cloud\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u8bb0\u5f55\u4e0b\u5c06346\u4e07\u6761\u8bbf\u95ee\u65e5\u5fd7\u901a\u8fc7Logstash\u53d1\u9001\u5230Elasticsearch\u7684\u65f6\u95f4 - Blog - Silicon Cloud","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/zh\/blog\/\u8bb0\u5f55\u4e0b\u5c06346\u4e07\u6761\u8bbf\u95ee\u65e5\u5fd7\u901a\u8fc7logstash\u53d1\u9001\u5230elasticsearch\u7684\u65f6\u95f4\u3002\/","og_locale":"zh_CN","og_type":"article","og_title":"\u8bb0\u5f55\u4e0b\u5c06346\u4e07\u6761\u8bbf\u95ee\u65e5\u5fd7\u901a\u8fc7Logstash\u53d1\u9001\u5230Elasticsearch\u7684\u65f6\u95f4","og_description":"\u9996\u5148 \u53ea\u662f\u4e3a\u4e86\u5728\u7a0d\u540e\u4f7f\u7528Kibana\u73a9\u800d\uff0c\u6211\u4eec\u540c\u65f6\u4f7f\u7528Logstash\u5c06\u6570\u636e\u6295\u5165Elasticsearch\u4e2d\uff0c [&hellip;]","og_url":"https:\/\/www.silicloud.com\/zh\/blog\/\u8bb0\u5f55\u4e0b\u5c06346\u4e07\u6761\u8bbf\u95ee\u65e5\u5fd7\u901a\u8fc7logstash\u53d1\u9001\u5230elasticsearch\u7684\u65f6\u95f4\u3002\/","og_site_name":"Blog - Silicon Cloud","article_published_time":"2023-11-22T23:03:19+00:00","article_modified_time":"2024-04-29T17:48:17+00:00","author":"\u6e05, \u626c","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"\u6e05, \u626c","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"3 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/","url":"https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/","name":"\u8bb0\u5f55\u4e0b\u5c06346\u4e07\u6761\u8bbf\u95ee\u65e5\u5fd7\u901a\u8fc7Logstash\u53d1\u9001\u5230Elasticsearch\u7684\u65f6\u95f4 - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website"},"datePublished":"2023-11-22T23:03:19+00:00","dateModified":"2024-04-29T17:48:17+00:00","author":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461"},"breadcrumb":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.silicloud.com\/zh\/blog\/"},{"@type":"ListItem","position":2,"name":"\u8bb0\u5f55\u4e0b\u5c06346\u4e07\u6761\u8bbf\u95ee\u65e5\u5fd7\u901a\u8fc7Logstash\u53d1\u9001\u5230Elasticsearch\u7684\u65f6\u95f4"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website","url":"https:\/\/www.silicloud.com\/zh\/blog\/","name":"Blog - Silicon Cloud","description":"","inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461","name":"\u6e05, \u626c","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g","caption":"\u6e05, \u626c"},"url":"https:\/\/www.silicloud.com\/zh\/blog\/author\/qingyang\/"},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e8%ae%b0%e5%bd%95%e4%b8%8b%e5%b0%86346%e4%b8%87%e6%9d%a1%e8%ae%bf%e9%97%ae%e6%97%a5%e5%bf%97%e9%80%9a%e8%bf%87logstash%e5%8f%91%e9%80%81%e5%88%b0elasticsearch%e7%9a%84%e6%97%b6%e9%97%b4%e3%80%82\/#local-main-organization-logo","url":"","contentUrl":"","caption":"Blog - Silicon Cloud"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/41128","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/comments?post=41128"}],"version-history":[{"count":2,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/41128\/revisions"}],"predecessor-version":[{"id":88943,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/41128\/revisions\/88943"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/media?parent=41128"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/categories?post=41128"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/tags?post=41128"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}