（1）部署redis

1丶安裝redis

yum install epel-release -y 
yum install redis -y 

2丶修改配置文件

#vim /etc/redis.conf 
bind 0.0.0.0 
daemonize yes 
save ""				
requirepass 123456

3.啟動redis
systemctl enable redis
systemctl restart redis

（2）配置logstash將日志寫入到redis中

1丶修改配置文件

input {file {path => "/var/log/messages"type => "systemlog"start_position => "beginning"stat_interval => "2"}
}output {if [type] == "systemlog" {redis {data_type => "list"host => "192.168.1.31"db => "6"port => "6379"password => "123456"key => "systemlog"}}
}

2丶啟動

logstash -f /etc/logstash/conf.d/redis.conf  -t
logstash -f /etc/logstash/conf.d/redis.conf

redis hyperloglog，3丶寫入日志到messages日志中

cat /etc/hosts  >>/var/log/messages

4丶登錄redis查看

# redis-cli -h 192.168.1.31
192.168.1.31:6379> auth 123456
OK
192.168.1.31:6379> select 6
OK
192.168.1.31:6379[6]> keys * 
1) "systemlog"
192.168.1.31:6379[6]> llen systemlog
(integer) 11292
192.168.1.31:6379[6]> lpop systemlog

（3）配置logstash從redis中取出數據到elasticsearch

1丶修改配置文件

input {redis {type => "systemlog"host => "192.168.1.31"password => '123456'port => "6379"db => "6"data_type => "list"key => "systemlog"}
}
output {if [type] == "systemlog" {elasticsearch {hosts => ["192.168.1.31:9200"]index => "redis-systemlog-%{+YYYY.MM.dd}"}}}

2丶啟動

logstash -f /etc/logstash/conf.d/redis.conf  -t
logstash -f /etc/logstash/conf.d/redis.conf

3丶啟動head插件查看索引

參考鏈接：

logstash配置文件語法，logstash通過redis收集日志 ： https://www.cnblogs.com/lovelinux199075/p/9112182.html