filebeat配置分析nginx的error.log和access.log

第一步：nginx打开Error.log配置

#user  nobody;
worker_processes  1;

#添加这一行，并指定error.log的存储位置
error_log  /var/log/nginx/error.log;
#pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

http {

  include       mime.types;
    default_type  application/octet-stream;
...

第二步：配置filebeat.yml
主要是更改inputs 和outputs

#=========================== Filebeat inputs =============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: true
  
  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/nginx/access.log

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["cdh03:9200"]
  indices:
    - index: "nginx-access-%{[agent.version]}-%{+yyyy.MM}"
      when.contains:
        message: "access"
    - index: "nginx-error-%{[agent.version]}-%{+yyyy.MM}"
      when.contains:
        message: "error"

setup.template.name: "nginx"
setup.template.pattern: "nginx-*"
setup.template.enabled: false
setup.template.overwrite: true

最后重启filebeat验证：