logstash debug test

 

JSON데이터 준비

# vi cat SendMessage.json
{"Hello": "World"}

 

 

logstash debug test 파일생성

# vi /etc/logstash/conf.d/test.conf

input {
  tcp {
    port => 5050
    codec => json
  }
}


output {
        file {
        path => "/var/log/logstash/logstash.log"
        codec => rubydebug
        }
}

5050포트로 json데이터를 받으면 output경로에 로그가 쌓이게끔 설정

 

 

실행 및 포트 확인

# /usr/share/logstash/bin/logstash -f test.conf
Using JAVA_HOME defined java: /apps/java
WARNING, using JAVA_HOME while Logstash distribution comes with a bundled JDK
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[INFO ] 2021-04-06 10:19:44.165 [main] runner - Starting Logstash {"logstash.version"=>"7.12.0", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc OpenJDK 64-Bit Server VM 25.282-b08 on 1.8.0_282-08 +indy +jit [linux-x86_64]"}
[WARN ] 2021-04-06 10:19:44.369 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2021-04-06 10:19:44.907 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[INFO ] 2021-04-06 10:19:45.700 [Converge PipelineAction::Create<main>] Reflections - Reflections took 25 ms to scan 1 urls, producing 23 keys and 47 values 
[INFO ] 2021-04-06 10:19:47.074 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>500, "pipeline.sources"=>["/etc/logstash/conf.d/test.conf"], :thread=>"#<Thread:0x7b423084 run>"}
[INFO ] 2021-04-06 10:19:47.526 [[main]-pipeline-manager] javapipeline - Pipeline Java execution initialization time {"seconds"=>0.45}
[INFO ] 2021-04-06 10:19:47.556 [[main]-pipeline-manager] tcp - Automatically switching from json to json_lines codec {:plugin=>"tcp"}
[INFO ] 2021-04-06 10:19:47.702 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}
[INFO ] 2021-04-06 10:19:47.721 [[main]<tcp] tcp - Starting tcp input listener {:address=>"0.0.0.0:5050", :ssl_enable=>false}
[INFO ] 2021-04-06 10:19:47.781 [Agent thread] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

# netstat -anp | grep LIST | grep 5050
tcp6       0      0 :::5050                 :::*                    LISTEN      16526/java    

 

 

전송

# nc 127.0.0.1 5050 < SendMessage.json

 

전송하게 되면 아래와 같이 찍힙니다.

[INFO ] 2021-04-06 10:22:13.872 [[main]>worker2] file - Opening file {:path=>"/var/log/logstash/logstash.log"}
[INFO ] 2021-04-06 10:22:42.746 [[main]>worker1] file - Closing file /var/log/logstash/logstash.log

 

로그확인시 정상적으로 처리된거 확인됩니다.

# cat /var/log/logstash/logstash.log

{
         "Hello" => "World",
    "@timestamp" => 2021-04-06T01:22:13.440Z,
          "host" => "localhost",
          "port" => 39320,
      "@version" => "1"
}