1下载及解压安装包
filebeat-7.3.1-linux-x86_64.tar.gz
2. 相关配置项
filebeat.inputs:
- type: log #定义收集日志的类型
enable: true #不使用自有收集日志的模板，而是使用手动配置获取日志
paths:
- /var/log/messages/
- /var/log/secure/ #配置获取的日志文件，也可以使用模糊获取日志，*.log
fields:
log_topic: osmessages #定义kafka topic名称
name:"10.10.23.39" #收集日志的主机名
----------------以下是输出配置------------------------------------
output.kafka:
enabled:true
hosts:["10.10.23.39:9092","10.10.23.40:9092","10.10.23.41:9092"]
version: "0.10"
topic:'%{[fields][log_topic]}' #引用topic至kafka
partition.round_robin:
reachable_only:true
worker: 2
required_acks: 1
compression:gzip
max_message_bytes:10000000
---------------以下是日志输出配置-----------------------------------
#================================ Logging ======================
# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
#logging.level: debug
logging.level: debug
# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]
3.Filebeat 启动方式
4.Filebeat 自过滤
processors： - drop_fields: fields: ["beat", "host", "agent", "source", "offset", "prospector"]
5. Filebeat 获取日志输出服务器IP
#================================ General ===================== # The name of the shipper that publishes the network data. It can be used to group # all the transactions sent by a single shipper in the web interface. name: 10.10.23.42 # The tags of the shipper are included in their own field with each # transaction published. #tags: ["service-X", "web-tier"] # Optional fields that you can specify to add additional information to the # output. #fields: # env: staging
