ELKF搭建

logstash

cat /etc/logstash/logstash.yml |grep -v '#'
path.data: /data/logstash/data
pipeline.ordered: auto
path.config: /data/logstash_conf/*.conf
config.reload.automatic: true
config.reload.interval: 3s

log.level: info
path.logs: /var/log/logstash

cat input.conf
# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
beats {
port => 5044
}
}

filebeat

[root@pro-bed-10-10-0-120 ~]# cat /etc/filebeat/filebeat.yml
filebeat.inputs:
filebeat.config.prospectors:
enabled: true
path: configs/*.yml
reload.enabled: true
reload.period: 10s
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: true
reload.period: 10s
output.logstash:
hosts: ["*********:5044"]

cat find_file_logstast.sh
#!/bin/bash
dir=$( find /logs/**/*.log)
for i in $dir
do
# echo $i
a1=${i//logs//}
b1=${a1///-}
c1=${b1/.log/}
# echo $c1
cd /etc/filebeat/configs
rm -rf ${c1}.yml
#if [ -f ${c1}.yml ];then
#echo "文件存在"
#else
echo "

- type: log
enabled: true
paths:
- $i
tags: ""$c1""
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after
multiline.timeout: 10s
" > ${c1}.yml
#fi
cd /data/logstash_conf
rm -rf ${c1}.conf
#if [ -f ${c1}.conf ];then
#echo "logstash配置文件存在"
#else
echo "
output {
if ""${c1}"" in [tags] {
elasticsearch {
action => ""index""
hosts => [""http://***************:9200""]
index => ""${c1}-%{+YYYY-MM-dd}""
user => ""**********""
password => ""**************""
}
}
}
" > ${c1}.conf
#fi
done
echo `date`
scp -r /data/logstash_conf/* **************:/data/logstash_conf/