1、下载并解压
地址:https://www.elastic.co/cn/downloads/beats/filebeat
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.3.0-linux-x86_64.tar.gz
tar zxvf filebeat-7.3.0-linux-x86_64.tar.gz
mv filebeat-7.3.0-linux-x86_64.tar.gz filebeat
2、配置
cd filebeat
vim filebeat.yml
enabled:true
paths:
- /data/logstash/*
scan_frequency: 1s
force_close_files: true
输出到logstash设置如下:
output.logstash:
# The Logstash hosts
hosts: ["localhost:5044"]
输出到es设置如下:
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["localhost:9200"]
3、启动
./filebeat -e -c filebeat.yml
重新读取启动:
rm -rf data/*
data里记录着读取文件的位置信息