root@unuse-tsar:/app/elk/filebeat-7.4.2-linux-x86_64# egrep -v "^.*#|^$" filebeat.yml filebeat.inputs: - type: log enabled: true paths: - /var/log/*.log filebeat.config.modules: path: ${path.config}/modules.d/*.yml reload.enabled: true setup.template.settings: index.number_of_shards: 1 setup.kibana: host: "192.168.174.30:4601" setup.dashboards.index: "nginx-*" setup.template.json.name: "nginx" setup.template.pattern: "nginx-*" setup.template.overwrite: true setup.ilm.enabled: auto setup.ilm.rollover_alias: "access-nginx-%{+yyyy.MM.dd}" setup.ilm.pattern: "nginx-%{+yyyy.MM.dd}" output.elasticsearch: hosts: ["192.168.174.30:8200"] indices: - index: "nginx-%{+yyyy.MM.dd}" when.contains: type: "nginx" processors: - add_host_metadata: ~ - add_cloud_metadata: ~
然后去启动：./filebeat -e
启动后会创建索引
filebeat的使用
配置nginx
root@unuse-tsar:/app/elk/filebeat-7.4.2-linux-x86_64# ./filebeat modules enable nginx Enabled nginx root@unuse-tsar:/app/elk/filebeat-7.4.2-linux-x86_64# cat modules.d/nginx.yml - module: nginx access: enabled: true var.paths: ["/path/to/log/nginx/access.log"] error: enabled: true
配置filebeat.yml
1 filebeat.inputs: 2 - type: log 3 enabled: false 4 paths: 5 - /var/log/nginx/*.log 6 filebeat.config.modules: 7 path: ${path.config}/modules.d/*.yml 8 reload.enabled: true 9 setup.template.enabled: false 10 setup.template.settings: 11 index.number_of_shards: 1 12 setup.kibana: 13 host: "192.168.174.30:4601" 14 setup.dashboards.index: "nginx-*" 15 setup.ilm.enabled: auto 16 setup.template.json.enabled: true 17 setup.template.json.name: "nginx" 18 setup.ilm.rollover_alias: "nginx-%{+yyyy.MM.dd}" 19 setup.ilm.pattern: "nginx-*" 20 output.elasticsearch: 21 hosts: ["192.168.174.30:8200"] 22 indices: 23 - index: "nginx-%{+yyyy.MM.dd}" 24 when.contains: 25 server.type: "nginx" 26 - index: "system-%{+yyyy.MM.dd}" 27 when.contains: 28 server.type: "system" 29 processors: 30 - add_host_metadata: ~ 31 - add_cloud_metadata: ~
配置elasticsearch index
root@unuse-tsar:/app/elk/filebeat-7.4.2-linux-x86_64# ./filebeat setup --index-management -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["192.168.174.30:8200"]'
配置kibana dashboards
root@unuse-tsar:/app/elk/filebeat-7.4.2-linux-x86_64# ./filebeat setup --dashboards