centos7系统直接安装filebeat并传输登录和history到elk

tar xvf filebeat-8.2.0-linux-x86_64.tar.gz -C /opt/
mv filebeat-8.2.0-linux-x86_64/ filebeat

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/secure
  fields:
    log_type: secure

- type: log
  enabled: true
  paths:
    - /var/log/command.log
  fields:
    log_type: command

output.logstash:
  hosts: ["IP:5044"]  #logstash 服务器
  enabled: true
  worker: 1
  compression_level: 3
  loadbalance: true

close_older: 10m
force_close_files: true

hostnamectl set-hostname  wlmq-xxx-xxx-server-125193

# vim /etc/bashrc
HISTDIR='/var/log/command.log'
# 定义Command日志的格式
export HISTTIMEFORMAT="{\"TIME\":\"%F %T\",\"HOSTNAME\":\"$HOSTNAME\",\"LI\":\"$(who -u am i 2>/dev/null| awk '{print $NF}'|sed -e 's/[()]//g')\",\"LU\":\"$(who am i|awk '{print $1}')\",\"NU\":\"${USER}\",\"CMD\":\""
# 输出日志到指定的log文件
export PROMPT_COMMAND='history 1|tail -1|sed "s/^[ ]\+[0-9]\+ //"|sed "s/$/\"}/">> ${HISTDIR}'

# 创建command.log
touch /var/log/command.log && chmod 666 /var/log/command.log

# 调试
cd /opt/filebeat
./filebeat -e -c filebeat.yml

# 后台启动
screen ./filebeat -e -c filebeat.yml