linux logger、rsyslog：
logger 生成 message 日志：logger -t aaaaaaaaa mmmmmmmmmmm
查看生成的日志：tail -f /var/log/messages
rsyslog 配置：/etc/rsyslog.conf
配置 rsyslog 输出到指定地址（如 logstash）：


重启 rsyslog 服务：service rsyslog restart

logstash 接收 rsyslog 消息：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
input {
  syslog {
    port => "514"
    add_field => [ "type", "syslog"]
  }
}
 
filter {
  if "syslog" in [type]
    {
       grok {}
       mutate {
        add_field => [ "a", "%{[host]}"]
        add_field => [ "b", "0"]
       }
    }
  geoip {}
}
 
output {
  kafka {
    bootstrap_servers => "192.168.0.100:9092"
    topic_id => "tttttest"
    #compression_type => "snappy"
    codec => "json"
  } 
 
 # stdout { codec => rubydebug }  # 调试输出
}