Installation and use of filebeat

Filebeat It's a lightweight log transport Agent, You can forward the specified log to Logstash、Elasticsearch、Kafka、Redis Wait .Filebeat Less occupied resources , And the installation and configuration is relatively simple , Support the current mainstream OS And Docker platform .

One ：Filebeat Installation and use

        1、 download

                Official website address ：https://www.elastic.co/cn/downloads/past-releases#filebeat

        2、 install

                Upload and unzip

                

         3、 go in filebeat Directory to create a configuration file

                At this point, we have verified the simplest configuration

                

                 

filebeat.inputs:
- type: stdin
  enabled: true
setup.template.settings:
  index.number_of_shards: 3
output.console:
  pretty: true
  enable: true         

        4、 Start command

                 ./filebeat -e -c itcast.yml

                

         5、 verification

                 Post-boot input hello enter , See the output at this time json For processed log data

                

         6、 Read the file

                1： modify - type: log

                2： Add read file address

                         paths:
                            - /home/cc/logs/*.log

                        
                3： Start the view. The file contents have been read at this time

                ​​​​​​​        
                

         7、 Custom field

                Two ways ：

                        【1】：tags：["web"]

        ​​​​​​​        ​​​​​​​            
                        【2】：

                        fields:
                            from: cc

                        

                  Start view ：

        ​​​​​​​        ​​​​​​​        ​​​​​​​

                        fields Add directly as add to child nodes ：

                                    Add command ：fields_under_root: true Is added to the root node

                        

                         

        8、 Output to Elasticsearch

                To configure ：

                output.elasticsearch:
                  hosts: ["192.168.231.146"]

        ​​​​​​​        

                verification ：

        ​​​​​​​         

        9、Module Use

                Use command ：./filebeat modules list You can view the settings Model

                       

                 Start command ：./filebeat modules enable nginx

                 To disable the command ：./filebeat modules disable nginx

                To configure ： Enter configuration file . To configure

                       

                        

                  Modify the configuration file

                        The original input type is commented out . To configure modules

        ​​​​​​​        ​​​​​​​        

                        ​​​​​​​