ELK-beats数据采集

部署前准备参考https://www.zutuanxue.com/home/4/52_138

​ # yum -y install filebeat

[root@node4 ~]# rpm -i filebeat-7.6.0-x86_64.rpm 
警告：filebeat-7.6.0-x86_64.rpm: 头V4 RSA/SHA512 Signature, 密钥 ID d88e42b4: NOKEY

-i install

参考官方手册

[root@node4 ~]# systemctl enable filebeat
Synchronizing state of filebeat.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install enable filebeat
Created symlink /etc/systemd/system/multi-user.target.wants/filebeat.service → /usr/lib/systemd/system/filebeat.service.

#没有修改配置文件，起不来
[root@node4 ~]# systemctl start filebeat

[root@node4 ~]# cat /etc/filebeat/filebeat.yml |grep -v '#' |grep -v '^$'
filebeat.inputs:
- type: log
  enabled: false			#默认false，修改为true
  paths:
    - /var/log/*.log		#收集日志的路径
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
#定义kibana地址
setup.kibana:
#定义ES地址接收数据
output.elasticsearch:
  hosts: ["192.168.98.201:9200"]		
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

注意：每做下一个实验前，建议大家把之前的索引数据清除，通过es-head，这样没有干扰，也好验证效果。否则那么多索引信息，对前期学习的你来说，干扰太多了。

[root@node4 ~]# cat /etc/filebeat/filebeat.yml |grep -v '#' |grep -v '^$'
filebeat.inputs:
- type: log
  enabled: true			#默认false，修改为true
  paths:
    - /var/log/messages		#收集日志的路径
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
#定义kibana地址
setup.kibana:
#定义ES地址接收数据
output.elasticsearch:
  hosts: ["192.168.98.201:9200"]		
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

[root@node4 ~]# systemctl restart filebeat

[root@node4 ~]# cat /etc/filebeat/filebeat.yml |grep -v '#' |grep -v '^$'
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/messages
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
setup.kibana:
#在output.*输出全局中插入这行插入，下面三行
#禁用ilm
setup.ilm.enabled: false
#设置索引模板名
setup.template.name: "node4_messages"
#索引前缀
setup.template.pattern: "node4_messages-*"
output.elasticsearch:
  hosts: ["192.168.98.201:9200"]
  #定义索引
  index: "node4_messages-%{+yyyy.MM.dd}"
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

[root@node4 ~]# cat /etc/filebeat/filebeat.yml |grep -v '#' |grep -v '^$'
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/messages
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
setup.kibana:
#定义输出到logstash
output.logstash:
  hosts: ["192.168.98.203:5044"]
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

[root@node3 conf.d]# cat filebeat_to_logstash_es.conf 
input {
    beats {
        port => 5044
    }
}

output {
    elasticsearch {
        hosts => ["192.168.98.201:9200"]
        index => "zutuanxue_node4-%{+YYYY.MM.dd}"  #定义索引
    }
}

[root@node4 ~]# systemctl restart filebeat
[root@node3 ~]# systemctl restart logstash