安装了Elasticsearch和Kibana后，接下来要安装Logstash。

环境

• VirtualBox 4.3

• ubuntu 14.04

• java8(1.8.0_25)

logstash(1.4.2)

安装Logstash

$ cd 
$ wget https://download.elasticsearch.org/logstash/logstash/logstash-1.4.2.tar.gz
$ sudo mv logstash-1.4.2.tar.gz /usr/local/
$ cd /usr/local
$ sudo tar zxvf logstash-1.4.2.tar.gz
$ sudo ln -s logstash-1.4.2 logstash

※请访问http://logstash.net/获取最新版本。

启动和操作确认

我准备了类似以下的Apache日志。

[ip] - - [27/Apr/2015:01:05:10 +0900] "GET [url]" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12F70"

※IP地址和URL已经被隐藏

※IP地址和URL已保密

※对于IP地址和URL已作隐去处理

※已隐去IP地址和URL信息

※请忽略IP地址和URL

创建配置文件

$ cd /usr/local/logstash
$ sudo mkdir conf
$ cd conf
$ sudo vim test.conf
-----
input { stdin {} }

filter {
  grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
    break_on_match => false
    tag_on_failure => ["parse_failure"]
  }
  date {
    match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
    locale => "en"
  }
}

output {
  stdout { codec => rubydebug }
}
-----

开始和运行确认

$ /usr/local/logstash/bin/logstash -f /usr/local/logstash/conf/test.conf
標準入力になるので、ここに上記ログを貼り付けます
[ip] - - [27/Apr/2015:01:05:10 +0900] "GET [url]" "Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12F70"
Enterで実行

{
        "message" => "[ip] - - [27/Apr/2015:01:04:24 +0900] \"GET [url]" 200 1375 \"-\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12F70\"",
       "@version" => "1",
     "@timestamp" => "2015-04-26T16:04:24.000Z",
           "host" => "[host]",
       "clientip" => "[ip]",
          "ident" => "[ident]",
           "auth" => "[auth]",
      "timestamp" => "27/Apr/2015:01:04:24 +0900",
           "verb" => "GET",
        "request" => "[url]",
    "httpversion" => "1.1",
       "response" => "200",
          "bytes" => "1375",
       "referrer" => "[referrer]",
          "agent" => "\"Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Mobile/12F70\""
}

已经被透视。

設定文件的內容 (shè de