工具定制文档

/etc/httpd/conf

httpd.conf

 listen 注意端口号

 access  注意正则类型

 

启动httpd  要重新启动

/app/httpd/bin

ps -ef|grep httpd

./httpd

localhost:8097

/bigdata/tools/filebeat

filebeat.yml

filebeat inputs:

type:log
enabled:true
path:/app/httpd/logs/access_log

elasticsearch output:
注释掉

logstash output:
解注释
port: 5044/5045

 

启动filebeat

 /bigdata/tools/filebeat
./filebeat -e -c filebeat.yml

 

/bigdata/tools/logstash/config

cp logstash-filebeat-csv.conf

启动logstash

./logstash -f ../config/logstash-filebeat-csv.conf