filebeat

cat update_playbook.yml

- hosts: all
remote_user: root
gather_facts: no
# vars:
# logstash_host: 127.0.0.1

tasks:

- name: stop filebeat
service: name=filebeat state=stopped enabled=yes
ignore_errors: yes

- name: remove filebeat
yum: name=filebeat state=removed
ignore_errors: yes

- name: copy filebeat.rpm
copy: src=filebeat-7.4.2-x86_64.rpm dest=/root/filebeat-7.4.2-x86_64.rpm owner=root group=root mode=0644

- name: Install filebeat.rpm
command: "{{ item }} chdir=/root"
with_items:
- rpm -Uvh filebeat-7.4.2-x86_64.rpm
ignore_errors: yes

- name: copy xxx_filebeat.yml
template: src=xxx_filebeat.yml dest=/etc/filebeat/filebeat.yml owner=root

- name: restart filebeat
service: name=filebeat state=restarted enabled=yes

 

cat xxx_filebeat.yml

filebeat.inputs:
- type: log
paths:
- /usr/local/nginx/logs/nginx.log
fields:
type: "nginx-log"
fields_under_root: true

- type: log
paths:
- /usr/local/nginx/logs/nginx.log
fields:
type: "nginx-log"
fields_under_root: true

output.logstash:
hosts: ["127.0.0.1:4514"]

/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat