filebeat配置采集多个文件（多索引）推送ES

 

Filebeat 根据不同的日志设置不同的索引#

 

配置如下：

filebeat.inputs:
- type: log
  paths:
    - /tmp/log/ecology
  encoding: GB2312
  fields:
    type: ecology
- type: log
  paths:
    - /tmp/log/stderr.log
  encoding: GB2312
  fields:
    type: strerr
- type: log
  paths:
    - /tmp/log/stdout.log
  encoding: GB2312
  fields:
    type: stdout
- type: log
  paths:
    - /tmp/log/workflow/workflow.log
  encoding: GB2312
  fields:
    type: workflow
- type: log
  paths:
    - /tmp/WEB-INF/sqllog/ecologysql
  encoding: GB2312
  fields:
    type: ecologySql

setup.template.name: "uat"
setup.template.pattern: "uat-*"
setup.ilm.enabled: false
output.elasticsearch:
  hosts: ["11.12.13.14:9200"]
  username: "elastic"
  password: "123456"
  index: "uat-%{[fields.type]}%-%{+yyyy-MM-dd}"
  indices:
    - index: uat-ecology-%{+yyyy-MM-dd}
      when.equals:
        fields.type: ecology
    - index: uat-strerr-%{+yyyy-MM-dd}
      when.equals:
        fields.type: strerr
    - index: uat-stdout-%{+yyyy-MM-dd}
      when.equals:
        fields.type: stdout
    - index: uat-workflow-%{+yyyy-MM-dd}
      when.equals:
        fields.type: workflow
    - index: uat-ecologySql-%{+yyyy-MM-dd}
      when.equals:
        fields.type: ecologySql