日志采集客户端 filebeat 安装部署

linux
----------------
1. 下载
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.5.1-linux-x86_64.tar.g
2. 安装
tar xf filebeat-5.5.1-linux-x86_64.tar.gz
mkdir /home/elk
mv filebeat-5.5.1-linux-x86_64 /home/elk/filebeat
3. 配置文件
配置文件：cat /home/elk/filebeat/filebeat.yml
   filebeat.prospectors:
    -
      fields: {log_type: "web-proxy-nginx-access"}
      paths:
        - /data/logs/nginx/access/www2.access.log
    -
      fields: {log_type: "web-proxy-nginx-error"}
      paths:
        - /data/logs/nginx/error/www2.error.log

output.kafka:
hosts: ["59.188.25.225:9092"]
topic: 'web-proxy-nginx-log'
partition.round_robin:
reachable_only: false
required_acks: 1
compression: gzip
max_message_bytes: 1000000

shipper:
tags: ["web-proxy-nginx-filebeat"]

4.启动和关闭：
   启动：nohup /home/elk/filebeat/filebeat -e -c /home/elk/filebeat/filebeat.yml &
   关闭：kill -9 `ps aux|grep filebeat|head -1|awk -F" " '{print $2}'`
   查看进程：ps aux |grep filebeat

window
-------------------
1. 下载
https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.5.1-windows-x86_64.zip
2. 解压到C:\Program Files\Filebeat
3. 添加服务
   以管理员允许powershell
   cd 'C:\Program Files\Filebeat'
   set-executionpolicy Unrestricted
   .\install-service-filebeat.ps1
   set-executionpolicy Restricted
4. 配置文件: filebeat.yml
   filebeat.prospectors:
    -
      fields: {log_type: "web-proxy-nginx-access"}
      paths:
        - D:\data\www\nginx-1.4.7\logs\web2.access.log
    -
      fields: {log_type: "web-proxy-nginx-error"}
      paths:
        - D:\data\www\nginx-1.4.7\logs\web2.error.log

output.kafka:
hosts: ["59.188.25.2xx:9092"]
topic: 'web-proxy-nginx-log'
partition.round_robin:
reachable_only: false
required_acks: 1
compression: gzip
max_message_bytes: 1000000

shipper:
tags: ["web-proxy-nginx-filebeat"]
5. 启动
power shell下执行：Start-Service filebeat

让filebeat重新全部读取日志
-------------------------------
filebeat会在data/registry中记录已经读取的日志，如果想要filebeat全部重新读取，删除data/registry文件，然后重启filebeat.

巴特西

日志采集客户端 filebeat 安装部署

最新文章

热门文章