ELK日志分析平台(四)filebeat更加轻量化的数据采集器(类似于logstash)

下载地址

[root&＃64;server4 ~]# yum install -y httpd ##统计httpd/access_log日志
[root&＃64;server4 ~]# systemctl start httpd.service
[root&＃64;server4 ~]# cd /var/www/html/
[root&＃64;server4 html]# echo server4 > index.html
[root&＃64;server4 html]# chmod 755 /var/log/httpd/ ##权限&＃xff0c;不然访问不到。必须可以读
[root&＃64;server3 ~]# curl 172.25.13.4/index.html ##别的主机访问&＃xff0c;增加日志信息[root&＃64;server4 ~]# ll filebeat-7.6.1-x86_64.rpm
-rw-r--r-- 1 root root 24694569 Dec 15 21:21 filebeat-7.6.1-x86_64.rpm
[root&＃64;server4 ~]# rpm -ivh filebeat-7.6.1-x86_64.rpm
warning: filebeat-7.6.1-x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY
Preparing... ################################# [100%]
Updating / installing...1:filebeat-7.6.1-1 ################################# [100%]
[root&＃64;server4 ~]# cd /etc/filebeat/
[root&＃64;server4 filebeat]# ls
fields.yml filebeat.reference.yml filebeat.yml modules.d
[root&＃64;server4 filebeat]# vim filebeat.yml
[root&＃64;server4 filebeat]# systemctl start filebeat.service
[root&＃64;server4 filebeat]# ps ax

[root&＃64;server4 filebeat]# vim filebeat.yml
#-------------------------- Elasticsearch output ------------------------------
setup.template.name: "server4"
setup.template.pattern: "server4-*"
setup.ilm.enabled: false
output.elasticsearch:# Array of hosts to connect to.hosts: ["172.25.13.2:9200"]index: "server4-%{&＃43;yyyy.MM.dd}"