启动elasticsearch后：
[admin@ELK config]$ netstat -tnlp|grep java(Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.)tcp6 0 0 127.0.0.1:9200 :::* LISTEN 22138/java tcp6 0 0 127.0.0.1:9300 :::* LISTEN 22138/java
再启动logstash出现报错
[root@ELK config]# logstash -f logstash-elasticsearch.conf OpenJDK 64-Bit Server VM warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads appropriately using -XX:ParallelGCThreads=NSending Logstash's logs to /usr/local/logstash-5.4.0/logs which is now configured via log4j2.properties[2017-05-25T08:05:03,717][ERROR][logstash.outputs.elasticsearch] Unknown setting 'host' for elasticsearch[2017-05-25T08:05:03,767][ERROR][logstash.agent ] Cannot create pipeline {:reason=>"Something is wrong with your configuration."}
其中logstash-elasticsearch.conf的配置如下：
input { stdin {} }output { elasticsearch { host => '127.0.0.1' } stdout { codec => rubydebug }}
解决方法：
将配置里面的host改为hosts，好像是因为文档的一个bug。
修改过后连接成功：
[2017-05-25T08:16:32,965][INFO ][logstash.pipeline ] Pipeline main startedThe stdin plugin is now waiting for input:[2017-05-25T08:16:33,156][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}{ "@timestamp" => 2017-05-25T12:16:32.992Z, "@version" => "1", "host" => "ELK", "message" => "test"}
In the elasticsearch input, it’s hosts no matter which version. However, in the elasticsearch output, it was host before Logstash 2.0 and then the property name has been standardized to hosts. – Val Mar 10 ‘16 at 13:22
参考自：https://stackoverflow.com/questions/32200868/logstash-input-from-elasticsearch-error
