ELK+Filebeat (2)

ELK+Filebeat收集多臺機器不一樣日誌

採坑：在使用了6.0版本的ELK之後，使用如上配置，if [type]匹配不到在filebeat裏面使用document_type定義的字符串。在屢次調試和詢問後，發如今6.0版本以上已經取消了document_type的定義。若是要實現以上的配置只能使用以下配置

Logstash 配置

[root@Kibana ~]# cat /usr/local/logstash/conf.d/beats.conf 
input {
  beats {
    port => 5044
  }
}
output {
    if [fields][service] == 'Tomcat'{ 
        elasticsearch {
                hosts => ["192.168.1.202:9200"]
		index => "tomcat-%{+YYYY.MM.dd}"
        }
    }
    if [fields][service] == 'Auth'{ 
        elasticsearch {
                hosts => ["192.168.1.202:9200"]
		index => "auth-%{+YYYY.MM.dd}"
        }
    }
    if [fields][service] == 'App'{
        elasticsearch {
                hosts => ["192.168.1.202:9200"]
                index => "app-%{+YYYY.MM.dd}"
        }
    }
    if [fields][service] == 'microservice'{
        elasticsearch {
                hosts => ["192.168.1.202:9200"]
                index => "microservice-%{+YYYY.MM.dd}"
        }
    }
}

　　

Filebeat 配置　

[root@mos-node1 filebeat]# cat filebeat.yml 
filebeat.prospectors:
- input_type: log
  paths:
    - /var/log/uusafe/*/*/server.log
  exclude_lines: ["^DBG","^$"] 
  fields:
    service: microservice
output.logstash:
  hosts: ["192.168.1.197:5044"]
  enabled: true
  worker: 1 
  compression_level: 3
  loadbalance: true