filebeat 监控多个文件,并且写入不同 index的 elasticsearch中

拼搏现实的明天。 2021-11-09 00:20 611阅读 0赞

filebeat.yml 的配置

#====================== input =================
    filebeat.inputs:
    - type: log
      enabled: true
      paths:
        -  /home/www/test/logs/*/*/info.log
      tags: ["codeflag-info-log"]
      fields:
        index: 'codeflag-test-info'
    - type: log
      enabled: true
      paths:
        -  /home/www/test/logs/*/*/error.log
      json.keys_under_root: true
      tags: ["codeflag-error_log"]
      fields:
        index: 'codeflag-test-error'
    - type: log
      enabled: true
      paths:
        -  /home/www/test/logs/*/*/service.log
      json.keys_under_root: true
      tags: ["codeflag-service_log"]
      fields:
        index: 'codeflag-test-service'
    - type: log
      enabled: true
      paths:
        -  /home/www/prod/logs/api/*/info.log
      tags: ["codeflag-info-log"]
      fields:
        index: 'codeflag-prod-info'
    - type: log
      enabled: true
      paths:
        -  /home/www/prod/logs/api/*/error.log
      json.keys_under_root: true
      tags: ["codeflag-error_log"]
      fields:
        index: 'codeflag-prod-error'
    - type: log
      enabled: true
      paths:
        -  /home/www/prod/logs/api/*/service.log
      json.keys_under_root: true
      tags: ["codeflag-service_log"]
      fields:
        index: 'codeflag-prod-service'
    
    
    #================ output =====================
    output.elasticsearch:
      hosts: ["172.18.0.219:9200"]
      indices:
        - index: "codeflag-test-info"
          when.contains:
            fields:
              index: 'codeflag-test-info'
        - index: "codeflag-test-error"
          when.contains:
            fields:
              index: 'codeflag-test-error'
        - index: "codeflag-test-service"
          when.contains:
            fields:
              index: 'codeflag-test-service'
        - index: "codeflag-prod-info"
          when.contains:
            fields:
              index: 'codeflag-prod-info'
        - index: "codeflag-prod-error"
          when.contains:
            fields:
              index: 'codeflag-prod-error'
        - index: "codeflag-prod-service"
          when.contains:
            fields:
              index: 'codeflag-prod-service'
    
    #============== Elasticsearch template setting ==========
    setup.template.name: "codeflag"
    setup.template.pattern: "codeflag-*"
    #setup.template.overwrite: false
    setup.template.enabled: true
    setup.kibana:
      host: "172.18.0.219:80"
    
    #================== processors config ===================
    processors:
    - drop_fields:
        fields: ["input_type", "offset", "beat.name","beat.version","beat.hostname","input.type","prospector.type","log.file.path"]