filebeat+redis+logstash+elasticsearch基本配置--适用于6.4版本
filebeat配置:
filebeat.inputs:
- type: log
enabled: true
paths:
- /opt/xxxx.log
fields: 在filebeat收集的消息后面新增加字段,用于后面logstash的区分,分别放置于不同的索引
service: xxx
fields_under_root: true
- type: log
enabled: true
paths:
- /xxx.log
fields:
service: xxxxx
fields_under_root: true
multiline.pattern: '^Caused by' ---用于收集java异常日志
multiline.negate: true
multiline.match: after
multiline.max_lines: 1000
output.redis:
hosts: ["xxx:6379"]
db: 0
time: 10
key: "xx" 放置于redis中的key值
logstash配置:
input {
redis {
host => "127.0.0.1"
data_type => "list"
key => "xxx" 与上述配置filebeat中的redis值保持一致
}
}
output {
if [service] == "xxx" {
elasticsearch {
hosts => ["http://xxx:9200"]
index => "xxx-%{+YYYY.MM.dd}"
}
}
if [service] == "xxx" {
elasticsearch {
hosts => ["http://10.157.25.7:9200"]
index => "xxx-%{+YYYY.MM.dd}"
}
}
}
elasticsearch配置:
cluster.name: my-cluster
node.name: es-node-3
path.data: /data/es/
path.logs: /data/logs/
network.host:xxxx
http.port: 9200
transport.tcp.port: 9300
discovery.zen.ping.unicast.hosts: ["xx","xx","xx"]
discovery.zen.minimum_master_nodes: 2
discovery.zen.ping_timeout: 60s