第一种方法:
vim /etc/filebeat/filebeat.yml
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
- type: log
# Change to true to enable this input configuration.
enabled: true
harvester_limit: 100
#close_eof : true
close_inactive : 10m
#close_timeout : true
ignore_older : 72h
clean_inactive : 73h
scan_frequency: 10s
# Paths that should be crawled and fetched. Glob based paths.
json.keys_under_root: true
paths:
- /etc/logs/*.log
- /var/www/logs/*.logs
第二种方法,增加个tag字段,区分不同地方的log,建议使用
- type: log
# Change to true to enable this input configuration.
#enabled: false
enabled: true
harvester_limit: 100
close_inactive: 10m
ignore_older: 168h
clen_inactive: 170h
scan_frequency: 10s
json.keys_under_root: true
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /var/log/*.log
tags: ["all"]
- type: log
# Change to true to enable this input configuration.
#enabled: false
enabled: true
harvester_limit: 100
close_inactive: 10m
ignore_older: 168h
clen_inactive: 170h
scan_frequency: 10s
json.keys_under_root: true
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /opt/logs/test.log
tags: ["only_test"]