ELK (elasticsearch,logstash,kibana)

question

When I used logstash in service ,such as service logstash start it did not work , but /opt/logstash/bin/logstash -f /etc/logstash/conf.d worked right

solution

Demo of conf

input {
    file {
        path => "/var/log/apache2/jjk_config_server.log"
        start_position => beginning 
    }
}
filter {
    grok {
        match => { "message" => "%{COMBINEDAPACHELOG}"}
    }
}
output {
    stdout {
	codec => rubydebug
    }
    elasticsearch {hosts => "localhost:9200" }
}

Pay attention

Permission

ll /var/log/apache2 -d
drwxr-x--- 2 root adm 4096 Dec 15 13:32 /var/log/apache2/

logstash was started by user logstash,so it couldn’t work when executed service logstash start