Logstash のインストール

 Logstashをインストールした。

参考にしたページ

• Logstash Reference [7.13] » Getting Started with Logstash » Installing Logstash
  
• Logstash Directory Layout 
•  Logstashのダウンロードページ

 

インストール方法

• バイナリからの インストール
• リポジトリからのインストール
• Dockerコンテナを実行
  

 

 バイナリからのインストール

• RPMパッケージをダウンロードしてインストールする。
• Logstashの最新の安定バージョンは、Logstashのダウンロードページにある。

 $ curl -L -0 https://artifacts.elastic.co/downloads/logstash/logstash-7.13.1-x86_64.rpm

$ sudo rpm -ivh logstash-7.13.1-x86_64.rpm

Verifying...                          ################################# [100%]
準備しています...              ################################# [100%]
更新中 / インストール中...
   1:logstash-1:7.13.1-1              ################################# [100%]
Using bundled JDK: /usr/share/logstash/jdk
Using provided startup.options file: /etc/logstash/startup.options
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/pleaserun-0.0.32/lib/pleaserun/platform/base.rb:112: warning: constant ::Fixnum is deprecated
Successfully created system startup script for Logstash 

 動作確認

•  -e オプションを使用してコマンドラインから直接構成を指定する。
• コマンドラインで構成を指定すると、ファイルを編集しなくても、構成をすばやくテストできます。
  
• 以下のパイプラインは、標準入力から入力を受け取り、その入力を構造化された形式で標準出力に移動します。
  

 $ sudo /usr/share/logstash/bin/logstash -e 'input { stdin { } } output { stdout {} }'

OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[INFO ] 2021-06-13 22:10:03.495 [main] runner - Starting Logstash {"logstash.version"=>"7.13.1", "jruby.version"=>"jruby 9.2.16.0 (2.5.7) 2021-03-03 f82228dc32 OpenJDK 64-Bit Server VM 11.0.11+9 on 11.0.11+9 +indy +jit [linux-x86_64]"}
[WARN ] 2021-06-13 22:10:03.934 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2021-06-13 22:10:05.518 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[INFO ] 2021-06-13 22:10:05.958 [Converge PipelineAction::Create<main>] Reflections - Reflections took 57 ms to scan 1 urls, producing 24 keys and 48 values
[WARN ] 2021-06-13 22:10:06.852 [Converge PipelineAction::Create<main>] stdin - Relying on default value of `pipeline.ecs_compatibility`, which may change in a future major release of Logstash. To avoid unexpected changes when upgrading Logstash, please explicitly declare your desired ECS Compatibility mode.
[INFO ] 2021-06-13 22:10:07.301 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>250, "pipeline.sources"=>["config string"], :thread=>"#<Thread:0x3005506b run>"}
[INFO ] 2021-06-13 22:10:08.309 [[main]-pipeline-manager] javapipeline - Pipeline Java execution initialization time {"seconds"=>1.0}
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.jrubystdinchannel.StdinChannelLibrary$Reader (file:/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jruby-stdin-channel-0.2.0-java/lib/jruby_stdin_channel/jruby_stdin_channel.jar) to field java.io.FilterInputStream.in
WARNING: Please consider reporting this to the maintainers of com.jrubystdinchannel.StdinChannelLibrary$Reader
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
[INFO ] 2021-06-13 22:10:09.472 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}
The stdin plugin is now waiting for input:
[INFO ] 2021-06-13 22:10:09.631 [Agent thread] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

• Logstashを開始した後、コマンドプロンプトで hello world と入力する

 hello world
{
       "message" => "hello world",
    "@timestamp" => 2021-06-13T13:05:47.606Z,
      "@version" => "1",
          "host" => "hostname"
}

•  ctrl+DでLogstashを終了する
  

 [INFO ] 2021-06-13 22:16:58.342 [[main]-pipeline-manager] javapipeline - Pipeline terminated {"pipeline.id"=>"main"}
[INFO ] 2021-06-13 22:16:58.420 [Converge PipelineAction::Delete<main>] pipelinesregistry - Removed pipeline from registry successfully {:pipeline_id=>:main}
[INFO ] 2021-06-13 22:16:58.506 [LogStash::Runner] runner - Logstash shut down.