1.安装filebeat

  1. [root@client ~]# wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.2.0-linux-x86_64.tar.gz
  2. [root@client ~]# tar zxvf filebeat-7.2.0-linux-x86_64.tar.gz
  3. [root@client ~]# mv filebeat-7.2.0-linux-x86_64 /usr/local/filebeat
  4. [root@client ~]# cd /usr/local/filebeat
  5. [root@client ~]# cp filebeat.yml filebeat.yml.bak
  7. # 修改配置文件（需要指定日志path和服务器ip）
  8. [root@client ~]# cat /usr/local/filebeat/filebeat.yml | grep -v "^$" |grep -v "^#" |grep -v "#"
  9. filebeat.inputs:
  10. - type: log
  11.   enabled: true
  12.   paths:
  13.    - /usr/local/seektruth/logs/aeonlife_prod/info.*.log
  14. #  exclude_files: [".gz$"] ：        #移除这个目录下面相关gz结尾的文件
  15. #  exclude_lines: ["^DBG"]：     #表示移除什么样的结尾的行。
  16.   fields:
  17.    appname: online-aeonlife-info-log
  18. - type: log
  19.   enabled: true
  20.   paths:
  21.    - /usr/local/seektruth/logs/aeonlife_prod/access.*.log
  22.   fields:
  23.    appname: online-aeonlife-access-log
  24. - type: log
  25.   enabled: true
  26.   paths:
  27.    - /usr/local/seektruth/logs/aeonlife_prod/error.*.log
  28.   fields:
  29.    appname: online-aeonlife-error-log
  30. filebeat.config.modules:
  31.   path: ${path.config}/modules.d/*.yml
  32.   reload.enabled: false
  33. setup.template.settings:
  34.   index.number_of_shards: 1
  35. setup.kibana:
  37. #----------------------------- Logstash output --------------------------------
  38. output.logstash:
  39.   hosts: ["192.168.3.3:5044"]
  40. processors:
  41.   - add_host_metadata: ~
  42.   - add_cloud_metadata: ~
  44. #----------------------------- kafka output --------------------------------
  45. #output.kafka:
  46. #  enabled: true
  47. #  hosts: ["192.168.3.3:9092"]
  48. #  topic表示filebeat将数据输出到topic为sparksys-log的主题下
  49. #  topic: sparksys-log

2.启动服务

  1. [root@client ~]# cd /usr/local/filebeat
  2. [root@client ~]# nohup ./filebeat &
  4. # 注意:filebeat没有监听端口，主要看日志和进程
  5. [root@client filebeat]# ps aux |grep filebeat
  6. root      3819  0.0  0.5  25944 11304 ?        Ssl  7月15   0:17 /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
  7. root      3879  0.0  0.0 112664   972 pts/1    S+   15:29   0:00 grep --color=auto filebeat
  8. root     26223  0.0  0.3  17488  7188 pts/1    Sl   15:00   0:00 ./filebeat