filebeat7.13.2部署

1.修改logstash配置文件./etc/conf.d/input.config

input{
#    file{            
#   path => ["/var/log/nginx/access.log"] 
#   type => "shopweb"  
#    }
     kafka {
        bootstrap_servers =>
            "192.168.89.150:9092,
            192.168.89.151:9092,
            192.168.89.152:9092"
        type => "nginx_log"
        codec => "json"
        topics => "nginx"
        decorate_events => true
        }
}

2.解压filebeat文件

3.修改filebeat配置文件./filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
  - /var/log/nginx/*.log
output.kafka:
  hosts: ["192.168.89.150:9092","192.168.89.151:9092","192.168.89.152:9092"]
  topic: 'nginx'

 4.启动filebeat

 nohup ./filebeat -e -c filebeat.yml &     #-e后面跟命令 -c指定配置文件