日志搜集平台ELK-filebeat-安装说明

1.软件安装

jyapp用户登录系统，下载二进制安装包http://op.jieyue.com/softdown/ELK/filebeat-6.3.2-linux-x86_64-nginx-prode.tar.gz

2.nginx 日志修改

第一步 注释以前的日志，添加json格式的日志

vi /usr/local/nginx/conf/nginx.conf  【注释以前的日志，添加json格式的日志】

#log_format main
#'$remote_user [$time_local] $http_x_Forwarded_for $remote_addr $request '
#'$http_x_forwarded_for '
#'$upstream_addr '
#'ups_resp_time: $upstream_response_time '
# '$status $body_bytes_sent "$http_referer" '
#'request_time: $request_time';
log_format main '{"@timestamp": "$time_iso8601",'

'"servername": "$http_host", '
'"remote_addr": "$remote_addr",'
'"referer": "$http_referer",'
'"request": "$request",'
'"request_time": "$request_time",'
'"status": $status,'
'"bytes":$body_bytes_sent,'
'"agent": "$http_user_agent",'
'"x_forwarded": "$http_x_forwarded_for",'
'"upstr_addr": "$upstream_addr",'
'"upstr_host": "$upstream_http_host",'
'"ups_resp_time": "$upstream_response_time" }';

第二步 执行nginx 配置检测

/usr/local/nginx/sbin/nginx -t

第三步 热加载服务

/usr/local/nginx/sbin/nginx -s reload

3.配置文件修改说明

4.服务的启动停止

cd /home/jyapp/filebeat-6.3.2-linux-x86_64 && sh fbt {start|stop|restart|test}