關(guān)于什么是elk，分別是干什么的，這里不多做介紹挎塌。

1徘六、去官網(wǎng)下載相關(guān)安裝包

下載地址，注意三個要下相同的版本榴都，歷史版本在下圖指示的這里待锈，找了很久才找到。

圖1 Elasticsearch下載頁面.jpg

2嘴高、安裝配置

要先啟動Elasticsearch竿音，然后才能啟動Logstash和Kibana。啟動Elasticsearch直接運行安裝目錄bin下的bat文件就行拴驮，Kibana也是直接運行bat文件春瞬。Logstash有點兒麻煩，啟動的時候要指定配置文件莹汤，所以得先創(chuàng)建個配置文件快鱼，默認提供了示例配置文件在config/logstash-sample.conf，可以參考編寫自己的配置文件纲岭。

下面是我的配置文件抹竹，監(jiān)聽多個file，統(tǒng)一輸出到Elasticsearch中：

 # Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  file {
    path => "C:/log/yoyo/back/spring.log"
    tags => ["back-dev"]
    #關(guān)鍵是這一句決定存入elasticsearch中文是否亂碼
    codec => plain{ charset => "GBK" } 
  }
}


input {
  file {
    path => "C:/log/yoyo/front/spring.log"
    tags => ["front-dev"]
    #關(guān)鍵是這一句決定存入elasticsearch中文是否亂碼
    codec => plain{ charset => "GBK" } 
  }
}



input {
  file {
    path => "C:/log/yoyo/marketing/spring.log"
    tags => ["marketing-dev"]
    #關(guān)鍵是這一句決定存入elasticsearch中文是否亂碼
    codec => plain{ charset => "GBK" } 
  }
}

output {

  if "back-dev" in [tags]{
        elasticsearch {
        hosts => ["http://172.19.17.117:9200"]
        index => "[back-dev]-%{+YYYY.MM.dd}"
        #user => "elastic"
        #password => "changeme"
     }
  }
  if "front-dev" in [tags]{
        elasticsearch {
        hosts => ["http://172.19.17.117:9200"]
        index => "[front-dev]-%{+YYYY.MM.dd}"
        #user => "elastic"
        #password => "changeme"
     }
  }
  
  if "marketing-dev" in [tags]{
        elasticsearch {
        hosts => ["http://172.19.17.117:9200"]
        index => "[marketing-dev]-%{+YYYY.MM.dd}"
        #user => "elastic"
        #password => "changeme"
     }
  }
  

}

配置文件編輯后止潮，就可以啟動Logstash了窃判，用如下命令：logstash -f logstash-test.conf。