Logstash需要安裝json_lines外掛。

logstash-plugin install logstash-codec-json_lines

在bin目錄下面新增檔案logstash.conf

配置資訊：

input {
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4560
    codec => json_lines
    type => "debug"
  }
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port 
 
=> 4561
    codec => json_lines
    type => "error"
  }
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4562
    codec => json_lines
    type => "business"
  }
  tcp {
    mode => "server"
    host => "0.0.0.0"
    port => 4563
    codec => json_lines
    type 
 
=> "record"
  }
}
filter{
  if [type] == "record" {
    mutate {
      remove_field => "port"
      remove_field => "host"
      remove_field => "@version"
    }
    json {
      source => "message"
      remove_field => ["message"]
    }
  }
}
output {
  elasticsearch {
    hosts 
 
=> "localhost:9200"
    index => "mall-%{type}-%{+YYYY.MM.dd}"
  }
}

執行bin目錄下的logstash.bat，啟動Logstash服務，啟動命令如下：

logstash -f logstash.conf