搭建filebeat

• 安装 ：rpm --import https://packages.elastic.co/GPG-KEY-elasticsearch
• 编辑：vim /etc/yum.repos.d/fb.repo
  [elastic-7.x]

  [elastic-7.x]
  name=Elastic repository for 7.x packages
  baseurl=https://artifacts.elastic.co/packages/7.x/yum
  gpgcheck=1
  gpgkey=https://artifacts.elastic.co/GPG-KEY-elastcsearch
  enabled=1
  autorefresh=1
  ​type=rpm-md

  
  
  ​
• yum安装：yum install filebeat -y
• 设置开机自启： systemctl enable filebeat
• 配置
  • 查看filebeat支持哪些模块

    [root@localhost yum.repos.d]# filebeat modules list

  • 开启支持模块

    filebeat modules enable system nginx mysql

  • 修改配置文件（备份原有的filebeat.yml,删除内容并添加，ip为两台kafka的ip）

    filebeat.inputs:
    - type: log
    enabled: true
    paths:
    - /var/log/nginx/sc_access.log
    output.kafka:
    enabled: true
    hosts: ["192.168.85.138:9092","192.168.85.146:9092"]
    topic: sc
    keep_alive: 10s

  • 在三台机器上vim /etc/hosts添加：

    192.168.149.131 nginx-filebeat-01
    192.168.149.132 kafka01
    192.168.149.133 kafka02

• 测试：telnet 192.168.85.138 9092（显示下面信息，表示正确）

  Trying
  192.168.149.132...
  Connected to
  192.168.149.132.
  Escape character is '^]'.

• 测试：在kafka上创建消费者，进入nginx的ip网址，刷新网址，kafka会有相应日志输出，证明连通