1、让filebeat收集日志时,按要求生成自定义的索引名称,按月来收集
[root@web filebeat]# cat filebeat.yml
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/nginx/access.log
output.elasticsearch:
hosts: ["10.0.0.10:9200","10.0.0.11:9200"]
index: "nginx-access-%{[beat.version]}-%{+yyyy.MM}"
setup.template.name: "nginx"
setup.template.pattern: "nginx-*"
2、重新启动filebeat服务
systemctl restart filebeat