filebeat采集日志数据到kafka（一）（filebeat-＞kafka-＞logstash-＞es）

一、filebeat安装
filebeat-kafka版本适配

1、安装包下载
https://www.elastic.co/cn/downloads/past-releases#filebeat
解压
2、新建yml配置文件，如test.yml

filebeat.inputs:
- type: log
  enabled: true
  paths:
  - /var/log/usermonitor/usermonitor.log
  fields:
    type: "usermonitor"
  fields_under_root: true
  exclude_files: [".gz$"]

- type: log
  enabled: true
  paths:
  - /var/log/secure
  fields:
    type: "secure"
  fields_under_root: true
  exclude_files: [".gz$"]

- type: log
  enabled: true
  paths:
  - /var/log/message*
  fields:
    type: "messages"
  fields_under_root: true
  exclude_files: [".gz$"]

max_procs: 1
max_bytes: 50000      
name: "1.1.1.1"

output.kafka:
  enabled: true
  hosts: ["ip:9092","ip:9092","ip:9092"]
  topic: "topic"
  username: "username"
  password: "password"

3、Filebeat启动和停止
启动：./filebeat -c test.yml
停止：kill -9 PID