1.修改logstash配置文件./etc/conf.d/input.config
input{
# file{
# path => ["/var/log/nginx/access.log"]
# type => "shopweb"
# }
kafka {
bootstrap_servers =>
"192.168.89.150:9092,
192.168.89.151:9092,
192.168.89.152:9092"
type => "nginx_log"
codec => "json"
topics => "nginx"
decorate_events => true
}
}
2.解压filebeat文件
3.修改filebeat配置文件./filebeat.yml
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/nginx/*.log
output.kafka:
hosts: ["192.168.89.150:9092","192.168.89.151:9092","192.168.89.152:9092"]
topic: 'nginx'
4.启动filebeat
nohup ./filebeat -e -c filebeat.yml & #-e后面跟命令 -c指定配置文件