ELK_filebeat多日志收集

1.配置filebeat.yml

利用fields.log_type进行分组，”fields.log_type”可自定义

#=========================== Filebeat inputs =============================

filebeat.inputs:

- type: log

  enabled: true

  paths:

    - D:\\ElasticSearch\\logs\\error.log

  fields:

    log_type: "error"

  

  multiline.pattern: '^[0-9]'

  multiline.negate: true

  multiline.match: after

- type: log

  enable: true

  paths:

    - D:\\ElasticSearch\\logs\\info.log

  fields:

    log_type: "info"

  

  multiline.pattern: '^[0-9]'

  multiline.negate: true

  multiline.match: after

#----------------------------- Logstash output --------------------------------

output.logstash:

  # The Logstash hosts

  hosts: ["192.168.56.10:5044"]

2.配置logstash.conf

input {

  beats {

    port => 5044

  }

}

output {

  if [fields][log_type] == "error" {

    elasticsearch {

      hosts => ["172.17.0.2:9200"]

      index => "filebeat_%{[fields][log_type]}-%{+YYYY.MM.dd}"

      user => "elastic"

      password => "123456"

    }

  }

  else if [fields][log_type] == "info" {

    elasticsearch {

      hosts => ["172.17.0.2:9200"]

      index => "filebeat_%{[fields][log_type]}-%{+YYYY.MM.dd}"

      user => "elastic"

      password => "123456"

    }

  }

  

}

3.重启logstash

docker restart logstash