filebeat to kafka

[root@elk_120 ~]# grep -v "#" /etc/filebeat/filebeat.yml | grep -v "^$"
filebeat.inputs:
- type: log
  paths:
    - /var/log/*.log
    - /var/log/messages
  fields:
    type: "systemlog"
    log_topic: "systemlog-1512-filebeat"
  fields_under_root: true
  exclude_lines: ["^DBG"]
  exclude_files: [".gz$"]
name: 10.1.234.120
output.kafka:
  enabled: true
  hosts: ["10.1.234.123:9092","10.1.234.124:9092","10.1.234.125:9092"]
  topic: "%{[log_topic]}"
  partition.round_robin:
    reachable_only: true
  worker: 2
  required_acks: 1
  compression: gzip
  max_message_bytes: 10000000

确认服务正常启动 

systemctl status filebeat

第二步，检查kafka 有没有日志写入

[root@localhost ~]# /usr/local/kafka/bin/kafka-topics.sh --list --zookeeper 10.1.234.200:2181
__consumer_offsets
nginx-accesslog-1512
systemlog-1512-filebeat