标签：elastic   factor   tor   multiple   esc   defining   his   logs   url   

lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 14.04.5 LTS
Release: 14.04
Codename: trusty

卸载deb版本的logstash

cp /etc/logstash/conf.d/*.conf    /bak
service stop logstash  
dpkg -P logstash

rm /usr/share/logstash
rm /etc/logstash
rm /var/lib/logstash
rm /var/log/logstash

下载对应版本的logstash

wget https://artifacts.elastic.co/downloads/logstash/logstash-5.3.1.zip
unzip logstash-5.3.1.zip -d /data/software/
ln -sv logstash-5.3.1 logstash
cd logstash

编辑配置文件

vim config/logstash.yml 

pipeline.workers: 8
pipeline.output.workers: 8
pipeline.batch.size: 10000
pipeline.batch.delay: 10

vim config/jvm.options 
-Xms2g
-Xmx2g

创建配置文件

mkdir conf.d
touch conf.d/index.conf   # 业务配置文件
mkdir data/data{1,2,3,4,5}
mkdir logs/log{1,2,3,4,5}

useradd elk 
chown -R elk.elk data/
chown -R elk.elk logs/

安装supervisor

pip install supervisor
mkdir /etc/supervisor

创建主配置文件

cat >>  supervisord.conf  <<EOF  
; supervisor config file

[unix_http_server]
file=/var/run/supervisor.sock   ; (the path to the socket file)
chmod=0700                       ; sockef file mode (default 0700)

[supervisord]
logfile=/var/log/supervisor/supervisord.log ; (main log file;default $CWD/supervisord.log)
pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
childlogdir=/var/log/supervisor            ; (‘AUTO‘ child log dir, default $TEMP)

; the below section must remain in the config file for RPC
; (supervisorctl/web interface) to work, additional interfaces may be
; added by defining them in separate rpcinterface: sections
[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

[supervisorctl]
serverurl=unix:///var/run/supervisor.sock ; use a unix:// URL  for a unix socket

; The [include] section can just contain the "files" setting.  This
; setting can list multiple files (separated by whitespace or
; newlines).  It can also contain wildcards.  The filenames are
; interpreted as relative to this file.  Included files *cannot*
; include files themselves.

[include]
files = /etc/supervisor/conf.d/*.conf
EOF

创建相关路径

cd /etc/supervisor
mkdir  conf.d/
mkdir /var/log/supervisor
mkdir /data/logs/supervisord/
cd conf.d/

创建子配置文件

cat >> logstash1.conf  <<EOF
[program:logstash1]
directory = /data/software/logstash
command = /data/software/logstash/bin/logstash --path.data=/data/software/logstash/data/data1 -f  /data/software/logstash/conf.d/index.conf  -l /data/software/logstash/logs/log1
autostart = true
autorestart = true
redirect_stderr=false
startretries = 3
user = elk
stdout_logfile_maxbytes = 500MB
stdout_logfile_backups = 5
stdout_logfile = /data/logs/supervisord/logstash-index-stdout.log
stderr_logfile_maxbytes = 500MB
stderr_logfile_backups = 5
stderr_logfile = /data/logs/supervisord/logstash-index-stderr.log
EOF

启动和运行

supervisord -c /etc/supervisor/supervisord.conf 
supervisorctl -c /etc/supervisor/supervisord.conf

supervisor 更改配置文件，必须要重启整个supervisor进场才能生效
supervisorctl -c /etc/supervisor/supervisord.conf shutdown 
supervisord -c /etc/supervisor/supervisord.conf 

ubuntu14 安装 logstash5.3.1

标签：elastic   factor   tor   multiple   esc   defining   his   logs   url   

原文地址：http://blog.51cto.com/395469372/2312547