logstash 多实例运行

执行logstash同步脚本时出现如下报错：

Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting

将原先的命令：

bin/logstash -f config/mailflow.conf

改为：

bin/logstash -f config/mailflow.conf --path.data=/logstash/mailflow

其中，--path.data是指存放数据的路径

同步最近1小时数据脚本：

input {
elasticsearch {
hosts => "ESIP:9200" #配置 elasticsearch的地址及index
index => "mailflow*"
query => '{ "query": {"range":{"@timestamp": {"gte": "now-1h"}}}}'
size => 10000 #配置遍历数据
scroll => "5m" # 配置遍历时间间隔
docinfo => true
}
}

filter {
mutate{
convert => { "time-taken" => "integer" }
}
}

output {
elasticsearch {
hosts => "esip:9200"
index => "%{[@metadata][_index]}"
document_type => "%{[@metadata][_type]}"
document_id => "%{[@metadata][_id]}"
}}