进入docker中的logstash 容器内：
jelex@bogon ~ % docker exec -it 7ee8960c99a31e607f346b2802419b8b819cc860863bc283cb7483bc03ba1420 /bin/sh
$ pwd
/usr/share/logstash
$ ls
bin CONTRIBUTORS Gemfile jdk logstash-core modules tools x-pack
config data Gemfile.lock lib logstash-core-plugin-api pipeline vendor
$ cd bin
$ ls
benchmark.bat ingest-convert.bat logstash-keystore logstash-plugin.bat pqrepair.bat
benchmark.sh ingest-convert.sh logstash-keystore.bat pqcheck ruby
cpdump logstash logstash.lib.sh pqcheck.bat setup.bat
dependencies-report logstash.bat logstash-plugin pqrepair system-install
安装插件：
$ logstash-plugin install logstash-codec-json_lines
logstash优化：官方的建议是提高每次批处理的数量，调节传输间歇时间。当batch.size增大，es处理的事件数就会变少，写入也就越快了
vim /etc/logstash/pipeline.yml
pipeline线程数，官方建议是等于CPU内核数
pipeline.workers: 24
实际output时的线程数
pipeline.output.workers: 24
每次发送的事件数
pipeline.batch.size: 10000
发送延时（ms）
pipeline.batch.delay: 10