filebeat采集多个文件配置参考

Posted 2023-04-06

参考技术A 主要filebeat配置：

filebeat.prospectors:

input_type: log

paths:

/var/log/rsyncd.log

input_type: log

paths:

/var/log/messages

fields:

syslog: messages

fields_under_root: true

#输出到es配置

output.elasticsearch:

hosts: ["10.211.121.75:9200","10.211.121.73:9200","10.211.121.74:9200"]

index: "logstash rsync %+YYYY.MM.dd"

indices:

index: "messages-%+yyyy.MM.dd"

when.contains:

syslog: messages #通过此处来将message日志写入到message 的index

username: "elastic"

password: "12345"

logging.level: warning

Filebeat 采集多个文件到es

主要filebeat配置：

#采集器

filebeat.prospectors:

• input_type: log
  paths:
  • /var/log/rsyncd.log
• input_type: log
  paths:
  • /var/log/messages
    fields:
    syslog: messages
    fields_under_root: true

#输出到es配置
output.elasticsearch:
hosts: ["10.211.121.75:9200","10.211.121.73:9200","10.211.121.74:9200"]
index: "logstashrsync%{+YYYY.MM.dd}"
indices:

• index: "messages-%{+yyyy.MM.dd}"
  when.contains:
  syslog: messages #通过此处来将message日志写入到message 的index

  username: "elastic"
  password: "12345"

logging.level: warning