filebeat 负载均衡到多个logstash配置

logstash配置文件

input {

  beats {

    port => 5044

    client_inactivity_timeout => 36000   # 如果不设置，会出现Failed to publish events: write tcp 192.168.12.141:53310->192.168.12.139:5044: write: connection reset by peer报错

  }

}


output {

  elasticsearch {

    hosts => ["http://es02:9200"]   # es集群

    index => "fotoable-%{+YYYY.MM.dd}"

  }

}

 

注意：设置完client_inactivity_timeout后查看filebeat日志依然会有Attempting to reconnect to backoff(async(tcp://es02:5044)) with 3 reconnect attempt(s)这种重试信息，原因待补充

 

filebeat配置文件output部分

output.logstash:


  # The Logstash hosts


  hosts: ["es01:5044","es02:5044"]   # 多个logstash的beats地址和端口


  loadbalance: true  # 启动负载均衡