Linux从入门到放弃 filebeat收集java日志

最新推荐文章于 2024-09-04 17:49:26 发布

欠了三年一场梦

最新推荐文章于 2024-09-04 17:49:26 发布

阅读量547

点赞数

分类专栏： elk 文章标签： elasticsearch java jar linux es

本文链接：https://blog.csdn.net/mcweiyi/article/details/107518872

版权

elk 专栏收录该内容

10 篇文章 0 订阅

订阅专栏

filebeat收集java日志

1、部署java环境
2、修改filebeat配置文件，来收集es的日志信息（主要是java的报错日志信息）

1、部署java环境

1、部署一个java环境

rpm -ivh jdk-8u102-linux-x64.rpm

2、安装es服务

rpm -ivh elasticsearch-6.6.0.rpm

3、配置jvm使用的内存，及修改es的配置文件

vim /etc/elasticsearch/jvm.options
-Xms256m
-Xmx256m

vim /etc/elasticsearch/elasticsearch.yml
aaanode.name: node-1

4、启动es服务，发现服务无法启动，报错信息如下

[2020-04-10T05:15:16,194][ERROR][o.e.b.Bootstrap          ] [5fhlQ3j] Exception
java.lang.IllegalArgumentException: unknown setting [aaanode.name] did you mean [node.name]?
	at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:482) ~[elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:427) ~[elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:398) ~[elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.common.settings.AbstractScopedSettings.validate(AbstractScopedSettings.java:369) ~[elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.common.settings.SettingsModule.<init>(SettingsModule.java:148) ~[elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.node.Node.<init>(Node.java:372) ~[elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.node.Node.<init>(Node.java:265) ~[elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.bootstrap.Bootstrap$5.<init>(Bootstrap.java:212) ~[elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:212) ~[elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:333) [elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:159) [elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:150) [elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:86) [elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:124) [elasticsearch-cli-6.6.0.jar:6.6.0]
	at org.elasticsearch.cli.Command.main(Command.java:90) [elasticsearch-cli-6.6.0.jar:6.6.0]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:116) [elasticsearch-6.6.0.jar:6.6.0]
	at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:93) [elasticsearch-6.6.0.jar:6.6.0]
[2020-04-10T05:15:16,200][WARN ][o.e.b.ElasticsearchUncaughtExceptionHandler] [5fhlQ3j] uncaught exception in thread [main]

2、修改filebeat配置文件，来收集es的日志信息（主要是java的报错日志信息）

1、修改配置文件

vim /etc/filebeat/filebeat.yml
[root@web es-software]# cat /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/elasticsearch/elasticsearch.log
  multiline.pattern: '^\['
  multiline.negate: true
  multiline.match: after
  tags: ["java"]
output.elasticsearch:
  hosts: ["10.0.0.10:9200","10.0.0.11:9200"]

    - index: "java-erro-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        tags: "java"
setup.template.name: "java"
setup.template.pattern: "java-*"