filebeat配置

filebeat配置

filebeat.prospectors:

- input_type: log
#读取日志的路径
  paths:
    - /opt/export/log/info-xxx.log
  fields:
    log_type: "monitor_log"

  fields_under_root: true
#过滤部分日志
  include_lines: ['Monitor_log']

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["xxx.xxx.xxx.xxx:5043","xxx.xxx.xxx.xxx:5043"]
  loadbalance: true

#================================ Logging =====================================

logging.level: info
logging.to_files: true
logging.to_syslog: false
logging.files:
  path: /opt/export/app/filebeat/logs
  name: mybeat.log
  keepfiles: 5

过滤不包含指定字段的日志, 并仅仅输出到logstash, 也可以直接输出到Elasticsearch

启动命令

1. 前台启动：关闭窗口连接后自动退出

./filebeat -e -c filebeat.yml

2. 后台启动:

nohup ./filebeat -e -c filebeat.yml >/dev/null 2>&1 &

3. 关闭:

kill -9 xxxx