架构如下，logstash-agent ---->redis---->logstash-server----->elasticsearch---->kibana
需求：想收集多个log文件，例如/var/log/messages, /var/log/logstash/logstash.err 两个日志文件；
logstash input和output 如何写，
input {
file {
path => "/var/log/messages"
type => "system"
}
}
input {
file {
path => "/var/log/logstash/logstash.err"
type => "logstash-err"
}
}
output {
if [type] == "system" {
redis {
data_type => "list"
key => "system-messages-test"
host => "10.54.22.97"
port => "6379"
db => "2"
}
}
if [type] == "logstash-err" {
redis {
data_type => "channel"
key => "logstash-err-cesi"
host => "10.54.22.97"
port => "6379"
db => "3"
}
}
}
还有一个：如下；
input {
redis {
data_type => "list"
key => "system-messages-test"
host => "10.54.22.97"
port => "6379"
db => "2"
}
redis {
data_type => "channel"
key => "logstash-err-cesi"
host => "10.54.22.97"
port => "6379"
db => "3"
}
}
output {
if [data_type] == "list" {
elasticsearch {
hosts => "10.54.22.97:9200"
index => "system-redis-messages-%{+YYYY.MM.dd}"
}
}
if [data_type] == "channel" {
elasticsearch {
hosts => "10.54.22.97:9200"
index => "logstash-err-%{+YYYY.MM.dd}"
}
}
原文：http://8684525.blog.51cto.com/8674525/1966815