官网下载filebeat
下载及介绍,略。注意,保持fielbeat和es的版本一致,否则可能会报错。
配置filebeat.yml
主要是:
日志文件路径
单条日志多行合并
kibana和es连接
可以参考官网:https://www.elastic.co/guide/en/beats/filebeat/6.3/index.html
下面是我的配置:
###################### Filebeat Configuration Example #########################
# This file is an example configuration file highlighting only the most common
# options. The filebeat.reference.yml file from the same directory contains all the
# supported options with more comments. You can use it as a reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/filebeat/index.html
# For more available modules and options, please see the filebeat.reference.yml sample
# configuration file.
#=========================== Filebeat inputs =============================
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
- type: log
enabled: true
paths:
- /xxx/*/*/*.log
- /xxx/xxx/*/*/*.log
# exclude_files: ['/home/zile/prod-log/gateway/*/*/*/*']
ignore_older: 12h
tail_files: false
# Optional additional fields. These fields can be freely picked
# to add additional information to the crawled log files for filtering
### Multiline options 多行处理,匹配以日期开头的
multiline.pattern: ^\[?\d{
4}\-\d{