ELK接入笔记

1，获取filebeat源

wget 10.19.68.93:9999/filebeat-7.7.1.tar.gz

 

2,修改配置

1，filebeat.yml

2, filebeat.service

vim filebeat.yml:

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /home/work/log/app/test/*
  fields:
    source: test-log


###分割线
setup.template.name: "test_"
setup.template.pattern: "test_*"
setup.template.overwrite: true
setup.template.enabled: true
setup.ilm.enabled: false
output.elasticsearch:
  hosts: ["127.0.0.1:9200"]//支持多个IP,分割
  username: "filebeat"
  password: "readonly"
  index: "test_%{[fields.source]}_%{+yyyy.MM.dd}"
  indices:
    - index: "test_%{+yyyy.MM.dd}"
      when.equals:
        fields:
          source: "test-log"

  
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

3,配置文件

cp filebeat.service /usr/lib/systemd/system/
systemctl start filebeat.service
systemctl status filebeat.service

4，验证是否安装成功