Logstash

在centos 6及之前的版本叫做syslog，centos 7开始叫做rsyslog，根据官方的介绍，rsyslog(2013年版本)可以达到每秒转发百万条日志的级别
The rocket-fast Syslog Server - rsyslog
RSYSLOG is the rocket-fast system for log processing. It offers high-performance, great security features and a modular design. While it started as a regular syslogd, rsyslog has evolved into a kind of swiss army knife of logging, being able to accept inputs from a wide variety of sources, transform them, and output to the results to diverse destinations.
The rocket-fast Syslog Server - rsyslog
http://www.rsyslog.com/
The rocket-fast Syslog Server - rsyslog
通常用于收集网络设备的日志
这种方式当并发达到一定程度，日志会写不进去，会丢失，那么如何解决，可使用redis缓存队列，数据写入redis中，在由redis写入logstash
haproxy —> local2 —> xxx:514 —> logstash —> elasearch —> kibana
haproxy配置文件
haproxy主机开启rsyslog服务
重启rsyslog服务
配置logstash
notion image
notion image
Loading...
目录