创建tomcat的topic
[root@localhost kafka]
Created topic tomcat.
[root@localhost kafka]
filebeat
[root@kafka02 ~]
filebeat.inputs:
- type: log
enabled: true
paths:
- /opt/tomcat/logs/catalina.out
multiline.pattern: ^\[
multiline.negate: true
multiline.match: after
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 3
output.kafka:
enabled: true
hosts: ["192.168.88.8:9092","192.168.88.17:9092","192.168.88.8:9092"]
topic: tomcat
[root@localhost ~]
[root@localhost ~]
logstash
[root@kafka02 ~]
input {
kafka {
bootstrap_servers => ["192.168.88.17:9092,192.168.88.8:9092,192.168.88.88:9092"]
group_id => "logstash"
topics => "msg"
consumer_threads => 5
}
}
filter {
json {
source => "message"
}
mutate {
remove_field => ["@version","fields","prospector","source","host","beat","input"," offset","log"]
}
}
output {
elasticsearch {
hosts => "192.168.88.8:9200"
index => "tomcat-%{+YYYY.MM.dd}"
}
}
[root@localhost ~]
[root@localhost logstash]
[root@localhost logstash]
[root@localhost logstash]
[root@localhost ~]
[root@localhost kafka]