ELKStack日志离线系统

通过Filebeat抽取数据到logstash中，转存到ElasticSearch中，最后通过Kibana进行展示
https://www.ibm.com/developerworks/cn/opensource/os-cn-elk-filebeat/index.html?ca=drs-&utm_source=tuicool&utm_medium=referral

下载地址：https://www.elastic.co/downloads
注意版本对应

安装FileBeat（filebeat-6.0.0）

更改配置：

#=========================== Filebeat prospectors =============================
filebeat.prospectors:
    enabled: true
      paths:
        - /var/log/*.log
        - /usr/local/logs/SyncService/*.log
        
#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["192.168.46.160:5000"]

参照配置：https://www.elastic.co/guide/en/beats/filebeat/current/configuring-howto-filebeat.html
启动命令：nohup ./filebeat -e -c filebeat.yml &

安装logstash（logstash-6.0.0）

增加log4j_filebeat.conf

#=========================== Filebeat prospectors =============================
filebeat.prospectors:
    enabled: true
      paths:
        - /var/log/*.log
        - /usr/local/logs/SyncService/*.log
        
#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["192.168.46.160:5000"]

启动命令：bin/logstash -f config/log4j_filebeat.conf

安装elasticsearch（elasticsearch-6.0.0）
vi config/elasticsearch.yml
增加如下内容

cluster.name: myelk
node.name: zk-datanode-01
path.data: /home/dinpay/data/es/data
path.logs: /home/dinpay/data/es/logs
network.host: zk-datanode-01
discovery.zen.ping.unicast.hosts: ["zk-datanode-01"]
http.port: 9200