filebeat + es 日志分析

官网下载filebeat

下载及介绍，略。注意，保持fielbeat和es的版本一致，否则可能会报错。

配置filebeat.yml

主要是：

日志文件路径

单条日志多行合并

kibana和es连接

可以参考官网：https://www.elastic.co/guide/en/beats/filebeat/6.3/index.html

下面是我的配置：

###################### Filebeat Configuration Example #########################

# This file is an example configuration file highlighting only the most common
# options. The filebeat.reference.yml file from the same directory contains all the
# supported options with more comments. You can use it as a reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/filebeat/index.html

# For more available modules and options, please see the filebeat.reference.yml sample
# configuration file.

#=========================== Filebeat inputs =============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.


- type: log
  enabled: true
  paths:
    - /xxx/*/*/*.log
    - /xxx/xxx/*/*/*.log

  # exclude_files: ['/home/zile/prod-log/gateway/*/*/*/*']
  ignore_older: 12h
  tail_files: false
  # Optional additional fields. These fields can be freely picked
  # to add additional information to the crawled log files for filtering

  ### Multiline options 多行处理，匹配以日期开头的
  multiline.pattern: ^\[?\d{
   4}\-\d{