filebeat收集nginx日志

在nginx服务器安装filebeat

修改filebeat配置文件

vim /etc/filebeat/filebeat.yml

setup.ilm.enabled: false

#修改kibana访问地址
setup.kibana:
  host: "172.16.6.101:5601"

#找到elasticsearch区块注释掉
#output.elasticsearch:
  # Array of hosts to connect to.
  # hosts: ["172.16.6.101:9200"]

#打开logstash,添加索引名称
output.logstash:
  # The Logstash hosts
  hosts: ["172.16.6.101:5044"]
  index: nginx

开启nginx配置模块

filebeat modules enable nginx

修改nginx模块配置

vim /etc/filebeat/modules.d/nginx.yml

- module: nginx

  access:
    enabled: true


    var.paths: ["/data/logs/nginx/*_access.log"]

启动filebeat

filebeat setup

systemctl start filebeat

添加索引名称

参考文章:
https://www.jianshu.com/p/5df9db5cda8f