Filebeat-7.3.0安装

Filebeat-7.3.0安装

1、下载解压Filebeat

网速慢的可以从华为云上下载
https://mirrors.huaweicloud.com/filebeat/7.3.0/filebeat-7.3.0-linux-x86_64.tar.gz

cd /opt && mkdir filebeat
cd /opt/filebeat/
wget https://mirrors.huaweicloud.com/filebeat/7.3.0/filebeat-7.3.0-linux-x86_64.tar.gz
tar -zxvf filebeat-7.3.0-linux-x86_64.tar.gz

2、修改配置文件

filebeat安装目录下
/opt/filebeat/filebeat-7.3.0-linux-x86_64/filebeat.yml

#=========================== Filebeat inputs =============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /opt/tomcat/apache-tomcat-8.5.54/logs/*.*
    #- c:\programdata\elasticsearch\logs\*
#-------------------------- Elasticsearch output ------------------------------
#output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["192.168.12.140:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

logstash安装目录下
/opt/logstash/logstash-7.3.0/config/my.conf

input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["http://192.168.12.136:9200","http://192.168.12.137:9200","http://192.168.12.138:9200"]
    index => "myapplog-%{+YYYY.MM.dd}"
    #user => "elastic"
    #password => "changeme"
  }
}

3、创建软链接

方便后续使用filebeat命令

ln -s /opt/filebeat/filebeat-7.3.0-linux-x86_64/filebeat /usr/bin/

4、启动Filebeat

filebeat -e -c filebeat.yml

5、停止Filebeat

ps -ef|grep filebeat
kill -9 进程号