執(zhí)行l(wèi)ogstash同步腳本時(shí)出現(xiàn)如下報(bào)錯(cuò)：

Logstash could not be started because there is already another instance using the configured data directory. If you wish to run multiple instances, you must change the "path.data" setting

將原先的命令：

bin/logstash -f config/mailflow.conf

改為：

bin/logstash -f config/mailflow.conf --path.data=/logstash/mailflow

其中，--path.data是指存放數(shù)據(jù)的路徑

同步最近1小時(shí)數(shù)據(jù)腳本：

input {
elasticsearch {
hosts => "ESIP:9200" #配置 elasticsearch的地址及index
index => "mailflow*"
query => '{ "query": {"range":{"@timestamp": {"gte": "now-1h"}}}}'
size => 10000 #配置遍歷數(shù)據(jù)
scroll => "5m" # 配置遍歷時(shí)間間隔
docinfo => true
}
}

filter {
mutate{
convert => { "time-taken" => "integer" }
}
}

output {
elasticsearch {
hosts => "esip:9200"
index => "%{[@metadata][_index]}"
document_type => "%{[@metadata][_type]}"
document_id => "%{[@metadata][_id]}"
}}