阿里雲ELK之filebeat和logstash配置

一 filebeat 主機環境安裝

雲助手安裝

wget "https://aliyun-client-assist.oss-accelerate.aliyuncs.com/linux/aliyun_assist_latest.rpm"
rpm -ivh --force aliyun_assist_latest.rpm
systemctl restart aliyun.service
aliyun-service -v
#若客戶端版本高於1.0.1.400，雲助手客戶端安裝成功。

安裝docker

#添加yum源。
yum install epel-release –y
yum clean all
#安裝並運行Docker。
yum install docker-io –y
systemctl start docker
#檢查安裝結果。
docker info

設置開機啓動
 

systemctl enable docker
systemctl daemon-reload

filebeat.yml  輸出到logstash 端口8000

filebeat.inputs:

- type: log
  enabled: true
  paths:
    - /data/server/author/logs/error.log
  tags: ["author-error"]
  multiline.pattern: '^\['
  multiline.negate: true
  multiline.match: after

setup.template.settings:
  index.number_of_shards: 3
 
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

建立logstash 管道 s1-port-8000

input {
    beats {
        port => "8000"
    }

}
filter {

}
output {

    if "author-error" in [tags]{
     elasticsearch {
     hosts => ["http://xxx:9200"]
     user => "username"
     password => "password"
     index => "%{+yyyy.MM.dd}-s1-author-error"
     }   
}