filebeat+logstash經過zabbix微信報警

1、安裝軟件：

一、在要收集日誌的機器上安裝filebeat：

1)、下載安裝：
cd /usr/local/src
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.3.3-linux-x86_64.tar.gz
tar xvf filebeat-5.3.3-linux-x86_64.tar.gz -C /usr/local
rm -f filebeat-5.3.3-linux-x86_64.tar.gz

2）、增長配置文件：
mkdir -p /etc/filebeat

cat >/etc/filebeat/filebeat.yml << EOF filebeat.prospectors:
- input_type: log
  paths:
    - /usr/local/wintel400/log/*.log
  fields:
    document_type: CTI02-wintel-log
  tail_files: true
  ignore_olde: 24h
output.logstash:
  hosts: ["192.168.22.214:5044"] EOF
注：增長各客戶端的配置文件時修改document_type的值，還有日誌收集的目錄。 

3)、啓動（調試時能夠用前臺啓動）： 
/usr/local/filebeat-5.3.3-linux-x86_64/filebeat -e -c /etc/filebeat/filebeat.yml
nohup /usr/local/filebeat-5.3.3-linux-x86_64/filebeat -e -c /etc/filebeat/filebeat.yml 

二、安裝logstash：

1)、安裝logstash（須要安裝java1.8）：
cd /usr/local/src
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.3.3.tar.gz
tar zxf logstash-5.3.3.tar.gz  -C /usr/local/ 
rm -f /logstash-5.3.3.tar.gz

2)、增長配置文件：
mkdir /etc/logstash    配置文件見下面

3)、啓動（調試時先用前臺啓動）：
/usr/local/logstash-5.3.3/bin/logstash -f /etc/logstash/
nohup /usr/local/logstash-5.3.3/bin/logstash -f /etc/logstash/ &

java1.8下載:
wget --no-cookies --no-check-certificate --header "Cookie: gpw_e24=http%3A%2F%2Fwww.oracle.com%2F; oraclelicense=accept-securebackup-cookie" "http://download.oracle.com/otn-pub/java/jdk/8u171-b11/512cd62ec5174c3487ac17c61aaa89e8/jdk-8u171-linux-x64.tar.gz"

logstash的配置文件：

input {beats  {port => 5045}}
filter {if [fields][document_type] == "WEB01-easycti-log" {
             mutate {
             add_field => [ "[@metadata][zabbix_key]" , "EasyctiLog" ]
             add_field => [ "[@metadata][zabbix_host]" , "HAI--WEB01" ]
             }
         }
         else if [fields][document_type] == "WEB02-easycti-log" {
             mutate {
             add_field => [ "[@metadata][zabbix_key]" , "EasyctiLog" ]
             add_field => [ "[@metadata][zabbix_host]" , "HAI--WEB02" ]
             }
         }
         else if [fields][document_type] == "WEB03-easycti-log" {
             mutate {
             add_field => [ "[@metadata][zabbix_key]" , "EasyctiLog" ]
             add_field => [ "[@metadata][zabbix_host]" , "HAI--WEB03" ]
             }
         }
         grok {
                  match => {
                  "message" => "\[%{GREEDYDATA:logtime}\] %{DATA:context}\.%{WORD:level}: %{GREEDYDATA:msg}"
                  }
         }
}
output {
        if [level] =~ /(ERR|error|ERROR)/ {
                zabbix {
                zabbix_host => "[@metadata][zabbix_host]"
                zabbix_key => "[@metadata][zabbix_key]"
                zabbix_server_host => "192.168.22.216"
                zabbix_server_port => "10051"
                zabbix_value => "message"
                }
                stdout { codec => rubydebug }
        }
}

easycti-log.conf

input {beats  {port => 5044}}

filter { if [fields][document_type] == "CTI01-wintel-log" {
             mutate {
             add_field => [ "[@metadata][zabbix_key]" , "WintelLog" ]
             add_field => [ "[@metadata][zabbix_host]" , "HAI--CTI01" ]
             }
         }
         else if [fields][document_type] == "CTI02-wintel-log" {
             mutate {
             add_field => [ "[@metadata][zabbix_key]" , "WintelLog" ]
             add_field => [ "[@metadata][zabbix_host]" , "HAI--CTI02" ]
             }
         }
        grok {
                  match => {
                  "message" => "%{GREEDYDATA:logtime} \[%{WORD:level}] %{GREEDYDATA:msg}"
                  }
         }
}
output {
        if [level] =~ /(ERR|WARNING)/ {
                zabbix {
                zabbix_host => "[@metadata][zabbix_host]"
                zabbix_key => "[@metadata][zabbix_key]"
                zabbix_server_host => "192.168.22.216"
                zabbix_server_port => "10051"
                zabbix_value => "message"
                }
                stdout { codec => rubydebug }
        }
}

wintel-log.conf

 2、配置zabbix：

 配置微信告警參考：http://www.cnblogs.com/kevingrace/p/5995875.html

一、配置zabbix，獲取logstash發過來的日誌：

1)、依次建立模板，應用集，監控項，觸發器。

2)、建立應用集：

3)、建立監控項：

 

4)、建立觸發器：