1、修改filebeat配置文件
vim /etc/filebeat/filebeat.yml
2、修改logstash配置文件
cd /etc/logstash/conf.d
vim file.conf
input {
beats {
port => 5044
}
}
filter{
if "tomcat8" in [tags]{
grok{
match => {"message" => "%{IP:ip_address}\ -\ -\ \[%{HTTPDATE:timestamp}\]\ %{QS:referrer}\ %{NUMBER:status}\ %{NUMBER:bytes}"}
}
date{
match => ["timestamp","dd/MMM/yyyy:HH:mm:ss Z"]
}
mutate{
remove_field => ["message"]
}
}
}
output {
if "tomcat7" in [tags]{
elasticsearch {
hosts => ["http://192.168.81.129:9200"]
index => "tomcat7-logstash-%{+yyyy.MM.dd}"
}
}
if "tomcat8" in [tags]{
elasticsearch {
hosts => ["http://192.168.81.129:9200"]
index => "tomcat8-logstash-%{+yyyy.MM.dd}"
}
}
}
3、kibana中查看