我們需要將不同日誌寫到不同得elasticsearch得不同index中,但是一臺機器只能啓動一個filebeat(相對而言)
可以用如下配置
以下配置基於filebeat7.5.1
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/nginx/access.log
json.keys_under_root: true
json.overwrite_keys: true
fields:
name: nginx-access
- type: log
enable: true
paths:
- /var/log/nginx/error.log
fields:
name: nginx-error
- type: log
enabled: true
paths:
- /home/www/logs/service-pay/service-pay.log
fields:
name: service-pay
tail_files: true
multiline.pattern: '^[[:space:]]+(at|\.{3})\b|^Caused by:'
multiline.negate: false
multiline.match: after
max_lines: 10
setup.template.name: "log-"
setup.template.pattern: "log-*"
setup.ilm.enabled: false
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["192.168.0.99:9200"]
index: "log-%{[fields][name]}-%{+yyyy-MM-dd}"
相當於給不同日誌定義個列 叫name通過這個name直接篩選屬於哪一個index,並且按天分片。