linux 下安装 filebeat

1、下载安装程序

下载地址：https://www.elastic.co/cn/downloads/beats/filebeat

2、安装 filebeat

rpm -ivh filebeat-7.9.3-x86_64.rpm

3、安装目录说明

4、修改配置文件

cat /etc/filebeat/filebeat.yml

filebeat.inputs:

- type: log
  enabled: true #改成true
  paths:
    - /home/jboss/logs/*.log #改 指定需要收集日志的路径，支持通配符可以写多个
  fields: 
    source: jboss
- type: log
  enabled: true
  paths: 
    - /home/nginx/*.log
  fields: 
    source: nginx

#==================== Elasticsearch template setting ==========================
setup.template.enabled: false
setup.template.name: "索引名"
setup.template.pattern: "索引名-*"
setup.template.overwrite: true
setup.ilm.enabled: false

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["192.168.2.200:9200"]
  index: "索引名-%{[fields.source]}-*"
  indices:
    - index: "索引名-jboss-%{+yyyyMMdd}" 
      when.equals: 
        fields: 
          source: "jboss"
    - index: "索引名-nginx-%{+yyyyMMdd}"
      when.equals:
        fields: 
          source: "nginx"