centos7中filebeat-安装-收集日志

原文连接：http://www.duozhi.online/2023/10/20/centos7%e4%b8%adfilebeat-%e5%ae%89%e8%a3%85-%e6%94%b6%e9%9b%86%e6%97%a5%e5%bf%97/

es安装参考：http://www.duozhi.online/2023/10/20/centos7%e4%b8%ades%e5%ae%89%e8%a3%85/

kibana安装参考：http://www.duozhi.online/2023/10/20/centos7%e4%b8%ad%e5%ae%89%e8%a3%85kibana/

1.节点信息

k8s集群的两个节点

192.168.0.203

192.168.0.204

2.filebeat搭建–两个节点相同操作

2.1下载安装包并解压

cd /home/filebeat
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.10.1-linux-x86_64.tar.gz
tar -xvf filebeat-7.10.1-linux-x86_64.tar.gz

[root@MES-203 filebeat]# cd filebeat-7.10.1-linux-x86_64
[root@MES-203 filebeat-7.10.1-linux-x86_64]# pwd
/home/filebeat/filebeat-7.10.1-linux-x86_64
[root@MES-203 filebeat-7.10.1-linux-x86_64]# ls -l
总用量 109188
drwxr-x---.  3 root root       60 11月  2 16:44 data
-rw-r--r--.  1 root root  3703475 12月  5 2020 fields.yml
-rwxr-xr-x.  1 root root 99349472 12月  5 2020 filebeat
-rw-r--r--.  1 root root   135562 12月  5 2020 filebeat.reference.yml
-rw-------.  1 root root    10037 11月  2 16:43 filebeat.yml
drwxr-xr-x.  3 root root       15 12月  5 2020 kibana
-rw-r--r--.  1 root root    13675 12月  5 2020 LICENSE.txt
drwxr-xr-x. 66 root root     4096 12月  5 2020 module
drwxr-xr-x.  2 root root     4096 12月  5 2020 modules.d
-rw-r--r--.  1 root root  8566190 12月  5 2020 NOTICE.txt
-rw-r--r--.  1 root root      814 12月  5 2020 README.md
[root@MES-203 filebeat-7.10.1-linux-x86_64]# 

2.2编辑配置文件

[root@MES-203 filebeat-7.10.1-linux-x86_64]# cat filebeat.yml grep -v '#'grep -v '^$'
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /logs/apps/prod/*.log
- type: filestream
  enabled: false
  paths:
    - /var/log/*.log
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
setup.kibana:
  host: "192.168.0.218:5601"
output.elasticsearch:
  hosts: ["192.168.0.215:9200","192.168.0.216:9200","192.168.0.217:9200"]
  username: "elastic"
  password: "tPtXYtJu3NJJSX5lenaq"
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

2.3设置开机启动并启动

[root@MES-203 filebeat-7.10.1-linux-x86_64]# cat /etc/systemd/system/filebeat.service 
[Unit]
Description=filebeat
Wants=network-online.target
After=network-online.target
 
[Service]
User=root
ExecStart=/home/filebeat/filebeat-7.10.1-linux-x86_64/filebeat -e -c /home/filebeat/filebeat-7.10.1-linux-x86_64/filebeat.yml 
Restart=always  #设置为掉线自动重启，进程强制杀掉后会自动重新启动
 
[Install]
WantedBy=multi-user.target

systemctl enable filebeat&&systemctl start filebeat

3.配置kibana

配置索引模式

查看收集到的日志

4.日志查询

Lucene(支持模糊查询)

KSQL–也能模糊查询

参考文献

https://cloud.tencent.com/developer/article/1833739
https://www.jianshu.com/p/4bf5a8b743d2

https://blog.csdn.net/UbuntuTouch/article/details/109495826