Centos6搭建ELK - 02 安装使用Filebeat和Logstash

安装Filebeat

官方文档：https://www.elastic.co/guide/...

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.13.3-x86_64.rpm
sudo rpm -vi filebeat-7.13.3-x86_64.rpm

配置文件路径

vim /etc/filebeat/filebeat.yml 

filebeat.inputs: # filebeat input输入
- type: log    # 标准输入
  paths:
    - /xxx/*.log
  fields:
    from: xxx
  fields_under_root: true

output.logstash:
  hosts: ["127.0.0.1:5044"]

启动服务

service filebeat start

查看日志

tail -f /var/log/filebeat/filebeat

安装Logstash

官方文档：https://www.elastic.co/cn/dow...

vim /etc/yum.repos.d/logstash.repo

[logstash-7.x]
name=Elastic repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

安装

sudo yum install logstash
rpm -ql logstash #查看安装目录
ln -s /usr/share/logstash/bin/logstash /bin/ #创建软链接

测试

logstash -e 'input { stdin { } } output { stdout {} }' #运行成功后输入任意内容测试

配置文件

input {
  beats {
    port => 5044
  }
}
output {
  elasticsearch {
     hosts => ["127.0.0.1:9200"]
     index => "xxx_%{+YYYY.MM.dd}"
  }
}

启动

initctl start logstash