ELK之filebeat收集多日志并自定义索引

ELK之filebeat自定义索引

filebeat6.x

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["192.168.31.234:9200"]
  index: "nginx-%{[beat.version]}-%{+yyyy.MM}"
setup.template.name: "nginx_web"
setup.template.pattern: "nginx_web-"
setup.template.enabled: false$
setup.template.overwrite: true$

filebeat7.x

output.elasticsearch:
  hosts: ["https://localhost:9200"]
  index: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "nginx_web"
setup.template.pattern: "nginx_web-"
setup.template.enabled: false$
setup.template.overwrite: true$

注：filebeat7.x和filebeat6.x的index不一样，