ELK日志采集

创建日志索引使文档按照时间字段datetime倒序排序
PUT http://ip:9200/索引名

{
    
    "settings" : {
    
        "number_of_shards": 1,
    	"number_of_replicas": 0 ,
        "index" : {
    
            "sort.field" : "time", 
            "sort.order" : "desc" 
        }
    },
    "mappings": {
    
        "properties": {
    
            "time": {
    
                "type": "date"
            }
        }
    }
}