Centos 7 配置 filebeat 6.4

添加yum源

cat > /etc/yum.repos.d/artifacts.repo <<EOF
[elastic-6.x]
name=Elastic repository for 6.x packages
baseurl=https://artifacts.elastic.co/packages/6.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF

安裝filebeat

yum install filebeat
systemctl enable filebeat

配置filebeat

cat  > /etc/filebeat/filebeat.yml <<EOF
################### Filebeat Configuration Example #########################

############################# Filebeat ######################################
filebeat:
  prospectors:
    - input_type: log
      paths:
        - /var/log/messages
      document_type: syslog
      fields: 
        type: syslog
        ip: "192.168.1.2"
      fields_under_root: true
    - input_type: log
      paths:
        - /u01/redis/log/redis_*.log
        - /u01/redis_cluster/log/node_*.log
        - /u01/redis_cluster/run/node_*.conf
      document_type: redis
      fields: 
        type: redis
        ip: "192.168.1.2"
      fields_under_root: true
registry_file: /var/lib/filebeat/registry
output.redis:
   hosts: "10.10.1.220"
   port: 6379
   #key: "redis"
   key: "%{[type]}"
   password: "xxxxxxxxxxxxx"
logging:
  level: warning
  to_files: true
  files:
    path: /var/log/mybeat
    name: mybeat
    rotateeverybytes: 10485760 # = 10MB
EOF
systemctl start filebeat

配置說明

filebeat:
  prospectors:
    - input_type: log 
      paths:
        - /var/log/messages     /*輸入日誌*/
      document_type: syslog
      fields: 
                    type: syslog      /*創建一個標籤定義日誌類型*/
        ip: "192.168.1.2"  /*創建一個標籤定義IP*/
      fields_under_root: true
    - input_type: log
      paths:
        - /u01/redis/log/redis_*.log   /*配置日誌*/
        - /u01/redis_cluster/log/node_*.log
        - /u01/redis_cluster/run/node_*.conf
      document_type: redis
      fields: 
        type: redis
        ip: "192.168.1.2"
      fields_under_root: true
registry_file: /var/lib/filebeat/registry
output.redis:
   hosts: "10.10.1.220"  /*redis服務器地址*/
   port: 6379   /*redis服務器端口*/
   key: "%{[type]}"    /*按自定義的類型寫入相應的KEY*/
   password: "xxxxxxxxxxxxx" /*redis服務器密碼*/
logging:
  level: warning
  to_files: true
  files:
    path: /var/log/mybeat  /*定義日誌位置*/
    name: mybeat
    rotateeverybytes: 10485760 # = 10MB