filebeat 配置

2.1下载安装包并解压
cd /home/filebeat
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.10.1-linux-x86_64.tar.gz
tar -xvf filebeat-7.10.1-linux-x86_64.tar.gz

[root@MES-203 filebeat]# cd filebeat-7.10.1-linux-x86_64
[root@MES-203 filebeat-7.10.1-linux-x86_64]# pwd
/home/filebeat/filebeat-7.10.1-linux-x86_64
[root@MES-203 filebeat-7.10.1-linux-x86_64]# ls -l
总用量 109188
drwxr-x---. 3 root root 60 11月 2 16:44 data
-rw-r--r--. 1 root root 3703475 12月 5 2020 fields.yml
-rwxr-xr-x. 1 root root 99349472 12月 5 2020 filebeat
-rw-r--r--. 1 root root 135562 12月 5 2020 filebeat.reference.yml
-rw-------. 1 root root 10037 11月 2 16:43 filebeat.yml
drwxr-xr-x. 3 root root 15 12月 5 2020 kibana
-rw-r--r--. 1 root root 13675 12月 5 2020 LICENSE.txt
drwxr-xr-x. 66 root root 4096 12月 5 2020 module
drwxr-xr-x. 2 root root 4096 12月 5 2020 modules.d
-rw-r--r--. 1 root root 8566190 12月 5 2020 NOTICE.txt
-rw-r--r--. 1 root root 814 12月 5 2020 README.md
[root@MES-203 filebeat-7.10.1-linux-x86_64]#

2.2编辑配置文件
[root@MES-203 filebeat-7.10.1-linux-x86_64]# cat filebeat.yml grep -v '#'grep -v '^$'
filebeat.inputs:
- type: log
enabled: true
paths:
- /logs/apps/prod/*.log
- type: filestream
enabled: false
paths:
- /var/log/*.log
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 1
setup.kibana:
host: "192.168.0.218:5601"
output.elasticsearch:
hosts: ["192.168.0.215:9200","192.168.0.216:9200","192.168.0.217:9200"]
username: "elastic"
password: "tPtXYtJu3NJJSX5lenaq"
processors:
- add_host_metadata:
when.not.contains.tags: forwarded
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~

2.3设置开机启动并启动
[root@MES-203 filebeat-7.10.1-linux-x86_64]# cat /etc/systemd/system/filebeat.service
[Unit]
Description=filebeat
Wants=network-online.target
After=network-online.target

[Service]
User=root
ExecStart=/home/filebeat/filebeat-7.10.1-linux-x86_64/filebeat -e -c /home/filebeat/filebeat-7.10.1-linux-x86_64/filebeat.yml
Restart=always #设置为掉线自动重启，进程强制杀掉后会自动重新启动

[Install]
WantedBy=multi-user.target

systemctl enable filebeat&&systemctl start filebeat