1.本次采用的一台主机，将所有的软件安装一台上进行测试工作。
2.安装部署：https://blog.51cto.com/hwg1227/2299995
3.简单调试
输出rubydebug input{ file { path => "/usr/local/log_test/*/*/*.log" start_position => "beginning" } }
output {
elasticsearch {
hosts => ["10.0.0.92:9200"]
index => "myre-%{+YYY.MM.dd}"
}
stdout {codec => rubydebug}
}
--------------------- 原文：https://blog.csdn.net/yelllowcong/article/details/80847425
4.nginx日志格式
log_format main ‘$remote_addr - $remote_user [$time_local] "$request" ‘ ‘$status $body_bytes_sent "$http_referer" ‘ ‘"$http_user_agent" "$http_x_forwarded_for" $request_time‘;
5.filter的定义 参考：https://www.cnblogs.com/52fhy/p/10160795.html
filter { grok { match => { "message" => "%{IPORHOST:remote_ip} - %{DATA:user_name} \[%{HTTPDATE:time}\] \"%{WORD:method} %{DATA:url} HTTP/%{NUMBER:http_version}\" %{NUMBER:response_code} %{NUMBER:body_sent:bytes} \"%{DATA:referrer}\" \"%{DATA:agent}\" \"%{DATA:x_forwarded_for}\" %{NUMBER:request_time}" } # remove_field => "message" } }
原文：https://www.cnblogs.com/hixiaowei/p/11079116.html