ELK之filebeat使用默认模块收集日志

最新推荐文章于 2024-03-04 23:43:57 发布

钱亿堆

最新推荐文章于 2024-03-04 23:43:57 发布

阅读量630

点赞数

分类专栏： elk

本文链接：https://blog.csdn.net/qianyidui/article/details/103666206

版权

elk 专栏收录该内容

3 篇文章 0 订阅

订阅专栏

filebeat使用自带模块收集Nginx默认日志

1、开启filebeat配置中的nginx模块

filebeat modules enable nginx

2、修改nginx模块的配置

vim /etc/filebeat/modules.d/nginx.yml

- module: nginx
  # Access logs
  access:
    enabled: true
    var.paths: ["/usr/local/nginx/logs/*access.log"]
  # Error logs
  error:
    enabled: true
    var.paths: ["/usr/local/nginx/logs/*error.log"]

3、配置filebeat模块的位置及输出

#================================ inputs =====================================

#============================= Filebeat modules ===============================

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true
  reload.period: 10s

#============================== Kibana =====================================
setup.kibana:
  host: "192.168.31.234:5601"

#================================ Outputs =====================================

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  hosts: ["192.168.31.234:9200"]
  indices:
    - index: nginx-access-%{[beat.version]}-%{+yyyy.MM}
      when.contains:
        fileset.name: "access"
    - index: nginx-error-%{[beat.version]}-%{+yyyy.MM}
      when.contains:
        fileset.name: "error"

setup.template.name: "nginx-"
setup.template.pattern: "nginx-*"
setup.template.enabled: false
setup.template.overwrite: true