环境
- 系统:centos7.5
- ES:6.6
- kinbana
- filebeta:6.6.0
- 应用:tomcat/nginx日志文件
filebeta和ES的版本最好对应
filebeta参考地址:https://elkguide.elasticsearch.cn/beats/file.html
filebeta及ES下载地址:https://elasticsearch.cn/download/
filebeta部署
1.上传文件只服务器指定目录
2. 解压缩
tar -zxvf filebeat-6.6.0-linux-x86_64.tar.gz
3. 修改filebeat.yml配置文件
下面示例为:根据日志头部时间分割
filebeat.inputs:
- type: log
enabled: true
paths:
- /data/logs/helloApp/helloApp.info.log
tail_files: true
multiline:
pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
negate: true
match: after
max_lines: 1000
timeout: 3s
tags: ["helloApp-info-log"]
fields:
index: 'helloApp-info-log'
appName: "helloApp"
level: "info"
#数据源的配置
output.elasticsearch:
hosts: ["ip:port","ip:port","ip:port"]
username: "username"
password: "password"
indices:
- index: "log-%{+yyyy.MM}"
when.contains:
fields:
index: "helloApp-info-log"
启动
# 启动命令
$ ./filebeat -e -c filebeat.yml
# 后台启动
nohup ./filebeat -e -c filebeat.yml -d "publish" >/dev/null 2>&1 &
$