1、安装filebeat
使用rpm安装
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.6.1-x86_64.rpm
rpm -vih filebeat-7.6.1-x86_64.rpm
2、安装apache服务,为filebeat采集apache日志做准备
[root@server7 ~]# yum install -y httpd ##统计httpd/access_log日志
[root@server7 ~]# systemctl start httpd.service
[root@server7 ~]# cd /var/www/html/
[root@server7 html]# echo server7 > index.html
[root@server7 html]# chmod 755 /var/log/httpd/ ##权限,不然访问不到。必须可以读
[root@server5 ~]# curl 172.25.200.7/index.html ##别的主机访问,增加日志信息
3、配置filebeat
[root@server7 ~]# cd /etc/filebeat/
[root@server7 filebeat]# ls
fields.yml filebeat.reference.yml filebeat.yml modules.d
[root@server7 filebeat]# vim filebeat.yml
[root@server7 filebeat]# systemctl start filebeat.service
[root@server7 filebeat]# ps ax
4、自定义名字模板
[root@server7 filebeat]# vim filebeat.yml
#-------------------------- Elasticsearch output ------------------------------
setup.template.name: "server7"
setup.template.pattern: "server7-*"
setup.ilm.enabled: false
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["172.25.200.5:9200"]
index: "server7-%{+yyyy.MM.dd}"
[root@server7 filebeat]# systemctl restart filebeat.service