es，logstash，redis，filebeat

logstash从redis中拿取数据后会删除reids中的key，就无法在redis中查询到beats输入的值。

----filebeat.yml
filebeat.inputs:
- type: tcp
  host: "0.0.0.0:8000"


output.redis:
    hosts: ["192.168.49.219:6379"]
    password: "huang"
    db: 5
    key: "school"
    timeout: 3



----logstash.conf
input {
    tcp {
        type => "tcp"
        port => 8888
    }
    beats {
        type => "beats"
        port => 9999
    }
    redis {
        type => "redis"
        data_type => "list"
        host => "192.168.49.219"
        port => "6379"
        password => "huang"
        db => 5
        key => "school"       
    }

}

output {
  stdout {}
  
  if [type] == "tcp" {
    elasticsearch {
    hosts => ["192.168.49.217:9200","192.168.49.218:9200","192.168.49.219:9200"]
    index => "logstash-tcp-%{+YYYY.MM.dd}"
    }
  } else if [type] == "beats" {
    elasticsearch {
    hosts => ["192.168.49.217:9200","192.168.49.218:9200","192.168.49.219:9200"]
    index => "logstash-beats-%{+YYYY.MM.dd}"
    }
  } else if [type] == "redis" {
    elasticsearch {
    hosts => ["192.168.49.217:9200","192.168.49.218:9200","192.168.49.219:9200"]
    index => "logstash-redis-%{+YYYY.MM.dd}"
    }
  } else {
    elasticsearch {
    hosts => ["192.168.49.217:9200","192.168.49.218:9200","192.168.49.219:9200"]
    index => "logstash-other-%{+YYYY.MM.dd}"
    }
  }
}