1，ubuntu 16.04 安装 Logstash 7.6

• 需要安装JDK

# which java
/opt/jdk-13.0.2/bin/java
# java --version
openjdk 13.0.2 2020-01-14
OpenJDK Runtime Environment (build 13.0.2+8)
OpenJDK 64-Bit Server VM (build 13.0.2+8, mixed mode, sharing)

# wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
OK
# sudo apt-get install apt-transport-https
# echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
deb https://artifacts.elastic.co/packages/7.x/apt stable main
# sudo apt-get update && sudo apt-get install logstash

• 安装包安装

# wget https://artifacts.elastic.co/downloads/logstash/logstash-7.6.0.deb
# dpkg -i logstash-7.6.0.deb

• 设置环境变量
• vim /root/.bashrc

export PATH=$PATH:/usr/share/logstash/bin

# source /root/.bashrc
# logstash --version
logstash 7.6.0

• 测试

# logstash -e 'input { stdin { } } output { stdout {} }'
The stdin plugin is now waiting for input:
[INFO ] 2020-03-02 14:19:04.379 [Agent thread] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[INFO ] 2020-03-02 14:19:04.583 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}

• 输入hello world

/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/awesome_print-1.7.0/lib/awesome_print/formatters/base_formatter.rb:31: warning: constant ::Fixnum is deprecated
{
       "message" => "hello world",
    "@timestamp" => 2020-03-02T06:20:04.979Z,
      "@version" => "1",
          "host" => "主机名"
}

参考：

1. Installing Logstash
2. ELK 安装Logstash
3. ubuntu 安装 JDK
4. Logstash 安装笔记