小编Det*_*ett的帖子

我正在尝试为 ELK 创建一个简单的 hello world，并且能够通过互联网查看 kibana 报告。我已经安装了 kibana、logstash、nginx 和 elasticsearch。这是我的/etc/logstash/conf.d/10-syslog.conf：

input {
  file {
    path => [ "/var/log/*.log", "/var/log/messages", "/var/log/syslog" ]
    type => "syslog"
  }
}

output {
  elasticsearch { host => localhost }
  stdout { codec => rubydebug }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date { …