ELK7.x日志系统搭建 3. 采用轻量级日志收集Filebeat

wget https://mirrors.huaweicloud.com/filebeat/7.6.0/filebeat-7.6.0-linux-x86_64.tar.gz
tar -zxvf filebeat-7.6.0-linux-x86_64.tar.gz

filebeat.inputs:
# 指定文件的输入类型log
- type: log 
  enabled: true
  # 指定要监控的日志，可以指定具体得文件或者目录
  paths:
    - /var/log/test-filebeat.log

# 输出方式 可以以文件输出
output.file:
  path: "/tmp"
  filename: "filebeat.txt"    

echo test >> /var/log/test-filebeat.log

output.logstash:
  hosts: ["192.168.179.124:5044"]

input {
    beats {
        port => 5044
    }
}

output {
    elasticsearch {
        hosts => ["192.168.179.124:9200"]        #elasticsearch服务器地址
        user => "elastic"
        password => "${ES_PWD}"
        index => "logstash-filebeat-%{+YYYY.MM.dd}"    #索引名称
    }
}

echo hello >> /var/log/test-filebeat.log

output.redis:
  hosts: ["192.168.179.124:6379"]
  key: "test-filebeat"
  db: 0
  timeout: 5

input {
    redis {
        data_type => "list"
        host => "192.168.179.124"
        port => "6379" 
        db => 0 # 指定库
        key => "test-filebeat" # 配置redis 键
    }
}

output {
    elasticsearch {
        hosts => ["192.168.179.124:9200"]        #elasticsearch服务器地址
        user => "elastic"
        password => "${ES_PWD}"
        index => "logstash-test-%{+YYYY.MM.dd}"    #索引名称
    }
}

./bin/logstash -f ./conf.d/logstash-filebeat.conf

echo test >> /var/log/test-filebeat.log