filebeat配置

filebeat配置

filebeat.prospectors:

- input_type: log
#读取日志的路径
  paths:
    - /opt/export/log/info-xxx.log
  fields:
    log_type: "monitor_log"

  fields_under_root: true
#过滤部分日志
  include_lines: ['Monitor_log']

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["xxx.xxx.xxx.xxx:5043","xxx.xxx.xxx.xxx:5043"]
  loadbalance: true

#================================ Logging =====================================

logging.level: info
logging.to_files: true
logging.to_syslog: false
logging.files:
  path: /opt/export/app/filebeat/logs
  name: mybeat.log
  keepfiles: 5

过滤不包含指定字段的日志, 并仅仅输出到logstash, 也可以直接输出到Elasticsearch

启动命令

  1. 前台启动:关闭窗口连接后自动退出
./filebeat -e -c filebeat.yml
  1. 后台启动:
nohup ./filebeat -e -c filebeat.yml >/dev/null 2>&1 &
  1. 关闭:
kill -9 xxxx

   版权声明

文章作者: liuzhihang
版权声明: 本博客所有文章除特別声明外,均采用 CC BY 4.0 许可协议。转载请注明来源!

评论