filebeat

filebeat 是go语言编写的轻量日志收集工具，建议和elk 其他组件版本保持一致

cat filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
  # 日志文件路径
  - /var/log/messages
  fields:
  # 搜集后日志的名字
    type: host-message
- type: log
  enabled: true
  paths:
  - /var/log/secure
  fields:
    type: host-secure
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
setup.kibana:
output.kafka:
  hosts: ["101.43.43.9:9092"]
  topic: '%{[fields.type]}'
  required_acks: 1
  compression: gzip
   # 大于 max_message_bytes的事件将被丢弃。若要避免此问题，请确保 Filebeat 不会生成大max_message_bytes的事件。
  max_message_bytes: 100000
#output.redis:
#  hosts: ["127.0.0.1:6379"]
#  key: "k8s-magedu-app1"
#  db: 1
#  timeout: 5
#  password: "123456"

启动服务

filebeat -e -c /etc/filebeat/filebeat.yml \
-path.home /opt/filebeat \
-path.config /etc/filebeat \
-path.data /var/lib/filebeat \
-path.logs /var/log/filebeat &

Type	Description	Default Location	Config Option
home	Home of the Filebeat installation.		path.home
bin	The location for the binary files.	{path.home}/bin
config	The location for configuration files.	{path.home}	path.config
data	The location for persistent data files.	{path.home}/data	path.data
logs	The location for the logs created by Filebeat.	{path.home}/logs	path.logs