ELK集群部署(五)之部署FileBeat

部署安装FileBeat数据采集

cd /usr/local/src
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.7.1-linux-x86_64.tar.gz
tar -zxf filebeat-7.7.1-linux-x86_64.tar.gz

监控/var/log/*.log的日志，并发送给logstash。
cat <<EOF > /usr/local/src/filebeat-7.7.1-linux-x86_64/oslog2es.yml
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*.log  

output.logstash:
  hosts: ["192.168.56.101:5044"]
EOF

监控/var/log/*.log的日志，并发送给kafka。
cat <<EOF > /usr/local/src/filebeat-7.7.1-linux-x86_64/oslog2kafka.yml
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*.log  
  
output.kafka:
  hosts: ["192.168.56.103:9092"]
  topic: kafka
  partition.round_robin:
    reachable_only: false
  required_acks: 1
  compression: gzip
  max_message_bytes: 1000000
EOF

启动filebeat

/usr/local/src/filebeat-7.7.1-linux-x86_64/filebeat -e -c /usr/local/src/filebeat-7.7.1-linux-x86_64/oslog2es.yml -d "publish"

后台运行
nohup /usr/local/src/filebeat-7.7.1-linux-x86_64/filebeat -e -c /usr/local/src/filebeat-7.7.1-linux-x86_64/oslog2es.yml -d "publish" &