配置logstash agent采集nginx日志并输出到RabbitMQ；为了排错，同时输出一份日志到本地。
# vim /etc/logstash/conf.d/ngx_log.confinput { file {\tpath =\u0026gt; "/usr/local/nginx/logs/api_json.log"\tcodec =\u0026gt; "json"\ttype =\u0026gt; "nginx" }}output { rabbitmq { \thost =\u0026gt; "RabbitMQ_server"\tport =\u0026gt; "5672"\tvhost =\u0026gt; "elk"\texchange =\u0026gt; "elk_exchange"\texchange_type =\u0026gt; "direct"\tkey =\u0026gt; "elk_key" user =\u0026gt; "liang" password =\u0026gt; "liang123"\t} stdout { codec =\u0026gt; rubydebug } }配置tomcat服务器输出json格式日志，修改工程的logback.xml配置文件，添加如下配置
\t\u0026lt;appender name="LOGSTASH" class="ch.qos.logback.core.rolling.RollingFileAppender"\u0026gt; \u0026lt;file\u0026gt;${catalina.base}/logs/tomcat_json.log\u0026lt;/file\u0026gt;\t \u0026lt;encoder class="net.logstash.logback.encoder.LogstashEncoder"\u0026gt;\t \u0026lt;charset\u0026gt;utf8\u0026lt;/charset\u0026gt;\t \u0026lt;/encoder\u0026gt; \t \u0026lt;rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy"\u0026gt; \t \u0026lt;fileNamePattern\u0026gt;${catalina.base}/logs/tomcat_json-%d{yyyy-MM-dd}.log\u0026lt;/fileNamePattern\u0026gt; \t \u0026lt;/rollingPolicy\u0026gt; \t\u0026lt;/appender\u0026gt; \u0026lt;root level="info"\u0026gt; \u0026lt;appender-ref ref="LOGSTASH" /\u0026gt; \u0026lt;/root\u0026gt;下载依赖的jar包logstash-logback-encoder到{CATALINA_BASE}/lib
wget http://central.maven.org/maven2/net/logstash/logback/logstash-logback-encoder/4.4/logstash-logback-encoder-4.4.jar配置logstash agent采集tomcat日志并输出到RabbitMQ
# vim /etc/logstash/conf.d/tomcat_log.confinput { file {\tpath =\u0026gt; "/usr/local/tomcat/logs/tomcat_json.log"\tcodec =\u0026gt; "json"\ttype =\u0026gt; "tomcat" }}output { rabbitmq { \thost =\u0026gt; "RabbitMQ_server"\tport =\u0026gt; "5672"\tvhost =\u0026gt; "elk"\texchange =\u0026gt; "elk_exchange"\texchange_type =\u0026gt; "direct"\tkey =\u0026gt; "elk_key" user =\u0026gt; "liang" password =\u0026gt; "liang123"\t} stdout { codec =\u0026gt; rubydebug } }配置logstash indexer把日志从RabbitMQ输出到Elasticsearch
# vim /etc/logstash/conf.d/rabbitmq.confinput { rabbitmq {\thost =\u0026gt; "127.0.0.1"\tsubscription_retry_interval_seconds =\u0026gt; "5"\tvhost =\u0026gt; "elk"\texchange =\u0026gt; "elk_exchange"\tqueue =\u0026gt; "elk_queue"\tdurable =\u0026gt; "true"\tkey =\u0026gt; "elk_key"\tuser =\u0026gt; "liang"\tpassword =\u0026gt; "liang123" }}output { if == "nginx" { elasticsearch { hosts =\u0026gt; "Elasticsearch_server:9200" user =\u0026gt; "logstash" password =\u0026gt; "123456"\t index =\u0026gt; "nginx-%{+YYYY.MM.dd}" } } else if == "tomcat" { elasticsearch { hosts =\u0026gt; "Elasticsearch_server:9200" user =\u0026gt; "logstash" password =\u0026gt; "123456"\t index =\u0026gt; "tomcat-%{+YYYY.MM.dd}" } } else {\tfile {\t path =\u0026gt; "/var/log/logstash/unknown_messages.log"\t } \t} stdout { codec =\u0026gt; rubydebug }}