Logstash配置文件

• 示例logstash.yml配置 ，主要用于控制logstash运行时的状态（注释内容留下以便学习）

# Settings file in YAML
#
# Settings can be specified either in hierarchical form, e.g.:
#
#   pipeline:
#     batch:
#       size: 125
#       delay: 5
#
# Or as flat keys:
#
#   pipeline.batch.size: 125
#   pipeline.batch.delay: 5
#
# ------------  Node identity ------------
#
# Use a descriptive name for the node:
#为节点使用描述性名称:
node.name: logstash-1
#
# If omitted the node name will default to the machine's host name
#为节点使用描述性名称:
# ------------ Data path ------------------
#
# Which directory should be used by logstash and its plugins
#logstash及其插件应该使用哪个目录
# for any persistent needs. Defaults to LOGSTASH_HOME/data
#任何持久的需求。默认为LOGSTASH_HOME/data
path.data: /home/vagrant/logstash-7.7.1/plugin-data
#
# ------------ Pipeline Settings --------------
#
# The ID of the pipeline.
#管道的ID。
# pipeline.id: main
#
# Set the number of workers that will, in parallel, execute the filters+outputs
#设置并行执行过滤器+输出的worker的数量
# stage of the pipeline.
#管道的阶段。
# This defaults to the number of the host's CPU cores.
#这是主机CPU内核的默认数量。
# pipeline.workers: 2
#
# How many events to retrieve from inputs before sending to filters+workers
#在发送到过滤器+工人之前，要从输入中检索多少事件
# pipeline.batch.size: 125
#
# How long to wait in milliseconds while polling for the next event
#在轮询下一个事件时，需要等待多长时间(毫秒)
# before dispatching an undersized batch to filters+outputs
#在分派一个小批量过滤器+输出
# pipeline.batch.delay: 50
#
# Force Logstash to exit during shutdown even if there are still inflight
#关闭期间强制退出Logstash，即使仍在飞行中
# events in memory. By default, logstash will refuse to quit until all
#内存中的事件。默认情况下，logstash将拒绝退出，直到全部退出
# received events have been pushed to the outputs.
#已将接收到的事件推入输出。
# WARNING: enabling this can lead to data loss during shutdown
#警告:启用此选项可能导致关机期间数据丢失
# pipeline.unsafe_shutdown: false

# Set the pipeline event ordering. Options are "auto" (the default), "true" or "false".
#设置管道事件顺序。选项有“auto”(默认)、“true”或“false”。
# "auto" will  automatically enable ordering if the 'pipeline.workers' setting
#“auto”将自动启用排序，如果“管道”。工人的设置
# is also set to '1'.
#也被设置为“1”。
# "true" will enforce ordering on the pipeline and prevent logstash from starting
# "true"将强制对管道进行排序，并阻止logstash启动
# if there are multiple workers.
#如果有多个worker。
# "false" will disable any extra processing necessary for preserving ordering.
# "false"将禁用任何必要的额外处理，以保持排序。
pipeline.ordered: auto
#
# ------------ Pipeline Configuration Settings --------------
#                           
# Where to fetch the pipeline configuration for the main pipeline
#从哪里获取主管道的管道配置
# path.config:

# Pipeline configuration string for the main pipeline
#主管道的管道配置字符串
# config.string:

# At startup, test if the configuration is valid and exit (dry run)
#在启动时，测试配置是否有效并退出(演练)
# config.test_and_exit: false

# Periodically check if the configuration has changed and reload the pipeline
#定期检查配置是否已更改并重新加载管道
# This can also be triggered manually through the SIGHUP signal
#这也可以通过SIGHUP信号手动触发
config.reload.automatic: true
#
# How often to check if the pipeline configuration has changed (in seconds)
#检查管道配置是否更改的频率(以秒为单位)
# Note that the unit value (s) is required. Values without a qualifier (e.g. 60) 
#注意单位值是必需的。没有限定符的值(例如60)
# are treated as nanoseconds.
##被视为纳秒。
# Setting the interval this way is not recommended and might change in later versions.
#不建议以这种方式设置间隔，在以后的版本中可能会更改。
# config.reload.interval: 3s
#
# Show fully compiled configuration as debug log message
#将已编译的配置显示为调试日志消息
# NOTE: --log.level must be 'debug'
#注意:——日志。级别必须是“调试”
# config.debug: false
#
# When enabled, process escaped characters such as \n and \" in strings in the
#属性中的字符串中的\n和\"等转义字符
# pipeline configuration files.
#管道配置文件。
# config.support_escapes: false
#
# ------------ Module Settings ---------------
# Define modules here.  Modules definitions must be defined as an array.
# The simple way to see this is to prepend each `name` with a `-`, and keep
# all associated variables under the `name` they are associated with, and
# above the next, like this:
#
# modules:
#   - name: MODULE_NAME
#     var.PLUGINTYPE1.PLUGINNAME1.KEY1: VALUE
#     var.PLUGINTYPE1.PLUGINNAME1.KEY2: VALUE
#     var.PLUGINTYPE2.PLUGINNAME1.KEY1: VALUE
#     var.PLUGINTYPE3.PLUGINNAME3.KEY1: VALUE
#
# Module variable names must be in the format of
#
# var.PLUGIN_TYPE.PLUGIN_NAME.KEY
#
# modules:
#
# ------------ Cloud Settings ---------------
# 云设置
# Define Elastic Cloud settings here.
# Format of cloud.id is a base64 value e.g. dXMtZWFzdC0xLmF3cy5mb3VuZC5pbyRub3RhcmVhbCRpZGVudGlmaWVy
# and it may have an label prefix e.g. staging:dXMtZ...
# This will overwrite 'var.elasticsearch.hosts' and 'var.kibana.host'
# cloud.id: <identifier>
#
# Format of cloud.auth is: <user>:<pass>
# This is optional
# If supplied this will overwrite 'var.elasticsearch.username' and 'var.elasticsearch.password'
# If supplied this will overwrite 'var.kibana.username' and 'var.kibana.password'
# cloud.auth: elastic:<password>
#
# ------------ Queuing Settings --------------
#
# Internal queuing model, "memory" for legacy in-memory based queuing and
#内部排队模型，“内存”为遗留在内存中的排队和
# "persisted" for disk-based acked queueing. Defaults is memory
#“持久化”用于基于磁盘的脱机队列。默认值是内存
# queue.type: memory
#
# If using queue.type: persisted, the directory path where the data files will be stored.
#如果使用队列。类型:persistent，数据文件将存储在其中的目录路径。
# Default is path.data/queue
#默认为path.data/queue
# path.queue:
#
# If using queue.type: persisted, the page data files size. The queue data consists of
#如果使用队列。类型:持久化，页面数据文件大小。队列数据由
# append-only data files separated into pages. Default is 64mb
#分隔为页面的仅追加数据文件。默认是64 mb
# queue.page_capacity: 64mb
#
# If using queue.type: persisted, the maximum number of unread events in the queue.
#如果使用队列。类型:持久化，表示队列中未读事件的最大数量。
# Default is 0 (unlimited)
# queue.max_events: 0
#
# If using queue.type: persisted, the total capacity of the queue in number of bytes.
#如果使用队列。类型:持久化，队列的总容量，单位为字节数。
# If you would like more unacked events to be buffered in Logstash, you can increase the
#如果你想在Logstash中缓冲更多未被锁定的事件，你可以增加
# capacity using this setting. Please make sure your disk drive has capacity greater than
#使用此设置的#容量。请确认您的磁盘驱动器的容量大于
# the size specified here. If both max_bytes and max_events are specified, Logstash will pick
#这里指定的大小。如果同时指定了max_bytes和max_events，则Logstash将进行选择
# whichever criteria is reached first
#首先达到的标准
# Default is 1024mb or 1gb
#默认为1024mb或1gb
# queue.max_bytes: 1024mb
#
# If using queue.type: persisted, the maximum number of acked events before forcing a checkpoint
#如果使用队列。类型:持久化，强制执行检查点之前已经过处理的最大事件数
# Default is 1024, 0 for unlimited
##默认值是1024,0表示无限
# queue.checkpoint.acks: 1024
#
# If using queue.type: persisted, the maximum number of written events before forcing a checkpoint
#如果使用队列。类型:持久化，强制执行检查点之前的最大写入事件数
# Default is 1024, 0 for unlimited
#默认值是1024,0表示无限
# queue.checkpoint.writes: 1024
#
# If using queue.type: persisted, the interval in milliseconds when a checkpoint is forced on the head page
#如果使用队列。类型:持久化，即在首页强制执行检查点时的毫秒间隔
# Default is 1000, 0 for no periodic checkpoint.
#默认为1000,0表示没有定期检查点。
# queue.checkpoint.interval: 1000
#
# ------------ Dead-Letter Queue Settings --------------
# Flag to turn on dead-letter queue.
#打开死信队列的#标志。
# dead_letter_queue.enable: false

# If using dead_letter_queue.enable: true, the maximum size of each dead letter queue. Entries
#如果使用dead_letter_queue。启用:true，每个死信队列的最大大小。条目
# will be dropped if they would increase the size of the dead letter queue beyond this setting.
#如果将死信队列的大小增加到超过此设置，则#将被删除。
# Default is 1024mb
# dead_letter_queue.max_bytes: 1024mb

# If using dead_letter_queue.enable: true, the directory path where the data files will be stored.
#如果使用dead_letter_queue。enable: true，数据文件存储的目录路径。
# Default is path.data/dead_letter_queue
#
# path.dead_letter_queue:
#
# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#指标REST端点的绑定地址
http.host: 127.0.0.1
#
# Bind port for the metrics REST endpoint, this option also accept a range
#为指标REST端点绑定端口，此选项也接受范围
# (9600-9700) and logstash will pick up the first available ports.
#(9600-9700)和logstash将获得第一批可用端口。
http.port: 9600-9700
#
# ------------ Debugging Settings --------------
#
# Options for log.level:
#   * fatal
#   * error
#   * warn
#   * info (default)
#   * debug
#   * trace
#
# log.level: info
# path.logs:
#
# ------------ Other Settings --------------
#
# Where to find custom plugins
# path.plugins: []
#
# Flag to output log lines of each pipeline in its separate log file. Each log filename contains the pipeline.name
# Default is false
# pipeline.separate_logs: false
#
# ------------ X-Pack Settings (not applicable for OSS build)--------------
#
# X-Pack Monitoring
# https://www.elastic.co/guide/en/logstash/current/monitoring-logstash.html
#xpack.monitoring.enabled: false
#xpack.monitoring.elasticsearch.username: logstash_system
#xpack.monitoring.elasticsearch.password: password
#xpack.monitoring.elasticsearch.hosts: ["https://es1:9200", "https://es2:9200"]
# an alternative to hosts + username/password settings is to use cloud_id/cloud_auth
#xpack.monitoring.elasticsearch.cloud_id: monitoring_cluster_id:xxxxxxxxxx
#xpack.monitoring.elasticsearch.cloud_auth: logstash_system:password
#xpack.monitoring.elasticsearch.ssl.certificate_authority: [ "/path/to/ca.crt" ]
#xpack.monitoring.elasticsearch.ssl.truststore.path: path/to/file
#xpack.monitoring.elasticsearch.ssl.truststore.password: password
#xpack.monitoring.elasticsearch.ssl.keystore.path: /path/to/file
#xpack.monitoring.elasticsearch.ssl.keystore.password: password
#xpack.monitoring.elasticsearch.ssl.verification_mode: certificate
#xpack.monitoring.elasticsearch.sniffing: false
#xpack.monitoring.collection.interval: 10s
#xpack.monitoring.collection.pipeline.details.enabled: true
#
# X-Pack Management
# https://www.elastic.co/guide/en/logstash/current/logstash-centralized-pipeline-management.html
#xpack.management.enabled: false
#xpack.management.pipeline.id: ["main", "apache_logs"]
#xpack.management.elasticsearch.username: logstash_admin_user
#xpack.management.elasticsearch.password: password
#xpack.management.elasticsearch.hosts: ["https://es1:9200", "https://es2:9200"]
# an alternative to hosts + username/password settings is to use cloud_id/cloud_auth
#xpack.management.elasticsearch.cloud_id: management_cluster_id:xxxxxxxxxx
#xpack.management.elasticsearch.cloud_auth: logstash_admin_user:password
#xpack.management.elasticsearch.ssl.certificate_authority: [ "/path/to/ca.crt" ]
#xpack.management.elasticsearch.ssl.truststore.path: /path/to/file
#xpack.management.elasticsearch.ssl.truststore.password: password
#xpack.management.elasticsearch.ssl.keystore.path: /path/to/file
#xpack.management.elasticsearch.ssl.keystore.password: password
#xpack.management.elasticsearch.ssl.verification_mode: certificate
#xpack.management.elasticsearch.sniffing: false
#xpack.management.logstash.poll_interval: 5s