Filebeat 安裝

官方文檔

https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html

 

一、下載

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.15.2-linux-x86_64.tar.gz
tar xzvf filebeat-7.15.2-linux-x86_64.tar.gz

二、查看當前filebeat 模塊

./filebeat modules list

三、啓用模塊

./filebeat modules enable system nginx kafka

四、配置日誌規範

https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-reference-yml.html

添加新的日誌配置，輸出到kafka中

filebeat.inputs:
- type: filestream
  enabled: true
  paths:
    - /data/logs/live/userevent.log
  fields:
    log_topic: notify-topic-prod


# ------------------------------ Kafka Output -------------------------------
output.kafka:
  hosts: ["10.61.153.47:9092"]
  topic: '%{[fields.log_topic]}'
  compression: gzip
  max_message_bytes: 1000000
  codec.format:
    string: '%{[message]}'

五、啓動filebeat

./filebeat -c userevent.yml
#後臺運行，寫入日誌到filebeat.out
./filebeat -c userevent.yml > filebeat.out &