filebeat+redis+logstash+es+kibana 多日志收集

最新推荐文章于 2023-07-13 19:45:50 发布

菜是原罪i

最新推荐文章于 2023-07-13 19:45:50 发布

阅读量153

点赞数

文章标签： linux

原文链接：https://blog.csdn.net/qq_36270681/article/details/118679331

版权

同时收集本地系统日志和docker 日志

[root@k8-node2-dc ~]#cat    /etc/filebeat/filebeat.yml  
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*.log
    - /var/log/messages
  tags: ["system-log-239"]
  exclude_lines: ['^DBG','^$']
 
- type: log
  enabled: true
  paths:
    - /var/lib/docker/containers/*/*.log
  tags: ["docker-log-239"]
  exclude_lines: ['^DBG','^$']
 
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true
setup.template.settings:
  index.number_of_shards: 1
output.redis:
  hosts: ["10.1.1.242:6679"]
  db: "10"
  password: "MkdGH*3ldf"
  key: "log-239"
  timeout: 5

enabled: true 开启多路径收集

[root@logstash-28 conf.d]# cat logstas-docker.conf 
input{
    redis {
    host => "10.1.1.242"
    port => "6679"
    password => "MkdGH*3ldf"
    db => "10"
    data_type => "list"
    key => "log-239"
  
}
}
  
output{
    if "docker-log-239" in [tags]  {
       elasticsearch {
            hosts => ["10.1.234.21:9200"]
            index => "docker-log-239-%{+YYYY.MM.dd}"
        }
       stdout{
           codec => rubydebug
       }
    }

[root@logstash-28 conf.d]# cat logstas-simple.conf 
input{
    redis {
    host => "10.1.1.242"
    port => "6679"
    password => "MkdGH*3ldf"
    db => "10"
    data_type => "list"
    key => "log-239"
  
}
}
  
output{
    if "system-log-239" in [tags]  {
       elasticsearch {
            hosts => ["10.1.234.21:9200"]
            index => "system-log-239-%{+YYYY.MM.dd}"
        }
       stdout{
           codec => rubydebug
       }
    }
}