mirror of
https://github.com/elastic/logstash.git
synced 2025-04-21 21:27:20 -04:00
37 lines
1.2 KiB
Text
37 lines
1.2 KiB
Text
cd ~/projects/logstash
|
|
%E rm ~/projects/logstash/etc/logstash-demo.yaml
|
|
|
|
vi etc/logstash-demo.yaml
|
|
:set paste
|
|
|
|
%K control+l
|
|
i
|
|
# Remember that logstash provides a way to specify inputs, filters, and
|
|
# outputs. For this demo, I'll just show inputs + outputs
|
|
---
|
|
inputs:
|
|
# You can also tag inputs for easier handling later in your pipeline.
|
|
linux-syslog: # this is the 'linux-syslog' tag
|
|
- /var/log/messages # watch /var/log/messages (uses eventmachine-tail)
|
|
- /var/log/kern.log
|
|
- /var/log/auth.log
|
|
- /var/log/user.log
|
|
apache-access: # similar, different tag.
|
|
- /var/log/apache2/access.log
|
|
apache-error:
|
|
- /var/log/apache2/access.log
|
|
#other:
|
|
#- amqp://myamqpserver/fanout/rawlogs # an amqp fanout as input
|
|
#- amqp://myamqpserver/topic/rawlogs # an amqp topic as input
|
|
#- syslog:/// # take input via syslog protocol over the network
|
|
outputs:
|
|
#- amqp://myamqpserver/topic/logs # broadcast logs to an AMQP topic
|
|
#- mongodb://mongoserver/logs # store events in mongodb
|
|
#- stdout:/// # send to stdout (like tail -f, but better)
|
|
#- syslog://syslogserver/ # send to another syslog server
|
|
- websocket:/// # send to websockets
|
|
%E sleep 3
|
|
|
|
%K Escape
|
|
|
|
ZZ
|