filebeat+logstash

filebeat的使用

1、配置日志路径

=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- input_type: log

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /Users/Downloads/logs/*.log

  # Exclude lines. A list of regular expressions to match. It drops the lines that are
  # matching any regular expression from the list.
  #exclude_lines: ["^DBG"]

2、配置 Logstash output

----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["host:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

启动filebeat

配置logstash

#input {
# stdin {}
#}
input{
  beats {
    host => "127.0.0.1"
    port => 5044
  }
# log4j {  
#        mode => "server"  
#        host => "127.0.0.1"  
#        port => 4567  
#    }
}
output{
   stdout {
      codec => rubydebug
   }
}

启动logstash
在指定目录下新建a.log

echo "123" >> a.log

就可以看到如下结果

至此已完结！