安装logstash服务。
logstash主目录下：vim es-es.conf
input {
elasticsearch {
hosts => ["10.128.120.171", "10.128.120.172", "10.128.120.173", "10.128.120.179", "10.128.120.235"]
# user => "*******"
# password => "*********"
index => "*"
size => 1000
scroll => "1m"
}
}
filter {
mutate {
remove_field => ["@timestamp", "@version"]
}
}
output {
elasticsearch {
hosts => ["10.13.133.121", "10.13.133.122", "10.13.133.123", "10.13.133.124", "10.13.133.125"]
# user => "********"
# password => "**********"
index => "%{[@metadata][_index]}"
}
}
启动：logstash -f es-es.conf