filebeat 自启脚本

crontab.sh -- 将start脚本推送到crontab中使用

start.sh --启动脚本具备重启、检测状态，自动拉起功能

代码如下

cat crontab.sh 
#!/bin/bash
res=`grep "Serverip" /etc/profile | wc -l`

if [ $res == 0 ];then
	/usr/bin/cp /etc/profile /etc/profile.bak
	Serverip=`ifconfig eth0|sed  -n '2p'|sed 's/^.*inet //'|sed 's/ .*//'`
	echo "export Serverip=$Serverip" >> /etc/profile
	echo "*/2 * * * * /data/filebeat-6.6.2-linux-x86_64/start.sh"  >> /var/spool/cron/root		

fi

Serverip是为了获取主机ip地址，给filebeat.yml添加一个字段使用的

cat start.sh 
#!/bin/bash
source /etc/profile
single=$1
export Serverip=`ifconfig eth0|sed  -n '2p'|sed 's/^.*inet //'|sed 's/ .*//'`
path=/data/filebeat-6.6.2-linux-x86_64
filename=filebeat.yml
exstart="${path}/filebeat -e -c ${path}/${filename}"
juage(){
	ps -ef | grep filebeat.yml | grep -v "grep" | awk -F " " '{print $2}'
}
if [ -z $1 ];then     #1-1判断有没有参数restart,没有继续向下
	juage=`juage`
	if [ -z ${juage} ];then   #1-1-1判断有无进程，没有继续向下启动
	     nohup	${path}/filebeat -e -c ${path}/${filename}  > /dev/null 2>&1 &
	     sleep 2
	     juage=`juage`
	     if [ -z ${juage} ];then  #1-1-1-1判断pid是否为空，启动成功失败
                echo -e "\033[31m 启动失败 \033[0m"
	     else
		echo -e "\033[32m 启动完成 ${juage}  \033[0m"
             fi
	else    #1-1-2有进程，不做操作提示已运行
		echo -e "\033[32m 程序已运行 \033[0m"
	fi
elif [ $1 == restart ];then  #1-2脚本第一个参数为restart 进行重启操作
	juage=`juage`
	kill -9 ${juage}   #杀掉进程
	sleep 0.5
	nohup      ${path}/filebeat -e -c ${path}/${filename} > /dev/null 2>&1 &
	sleep 2
	juage=`juage`
	if [ "${juage}" != "" ];then  #1-2-1有进程不为空 启动成功
		echo -e  "\033[32m 重启完成 ${juage} \033[0m"
	else
		echo -e "\033[31m 重启失败 \033[0m"  #1-2-1否则 失败
	fi
fi

提供filebea.yml 供参考

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /data/ywgl/nginx/logs/tcp-access.log
  tags: ["nginx-tcp-access"]

  fields_under_root: true   
  fields:
    hostip: ${Serverip}

- type: log
  enabled: true
  paths:
    - /data/ywgl/nginx/logs/error.log
  tags: ["nginx-error"]
  multiline.pattern: '^ \['   #处理开头换行
  multiline.negate: true        #当前配置和下面的配置根据官网的解释配的 
  multiline.match: after
 
  fields_under_root: true   
  fields:
    host: ${Serverip}

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 3



processors:
  - drop_fields:
      fields: ["beat.hostname","beat.name","beatType","offset","input.type","beat.version"]

output.logstash:
  hosts: ["ip:5044"]