https://hub.docker.com/r/prima/filebeat/

https://www.elastic.co/cn/downloads/beats/filebeat

https://www.docker.elastic.co/r/beats

#Elasticsearch-7:   

https://abc.htmltoo.com/thread-46067.htm

#Elasticsearch-6:   

https://abc.htmltoo.com/thread-46050.htm

# docker run

docker run -d  --net=host  --name filebeat  --restart=always  -v /etc/localtime:/etc/localtime:ro  -v /data/docker/monitor/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro  docker.elastic.co/beats/filebeat:7.9.0   filebeat -e -strict.perms=false

应用: monitor -> 添加服务: filebeat

镜像: docker.elastic.co/beats/filebeat:7.9.0

卷:

/data/docker/monitor/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro

/data/file:/data/file

/etc/localtime:/etc/localtime:ro

===================================

# 配置.其他人不能写

chmod -R 755 /data/docker/monitor/filebeat/filebeat.yml

vi  /data/docker/monitor/filebeat/filebeat.yml

#=========================== Filebeat inputs =============================

#=========================== Filebeat inputs =============================
filebeat.inputs:

- type: log
  enabled: true
  tags: ["error"]
  paths:
    - /data/file/logs/nginx/error.log
  fields:
    filetype: error
  fields_under_root: true
- type: log
  enabled: true
  tags: ["fluentd"]
  paths:
    - /data/file/logs/fluentd/docker.*.log
  fields:
    filetype: fluentd
  fields_under_root: true
- type: log
  enabled: true
  tags: ["nginx"]
  paths:
    - /data/file/logs/nginx/nginx_*.log
  fields:
    filetype: nginx
  fields_under_root: true
#- type: log
  #enabled: true
  #tags: ["syslog"]
  #paths:
    #- /var/log/messages
    #- /var/log/secure
  #fields:
    #filetype: syslog
  #fields_under_root: true

......

#-------------------------- Redis output ------------------------------
output.redis:
  hosts: ["redis:6379"]   #输出到redis的机器
  password: "wdqdmm@r"
  key: "filebeat:logstash"   #redis中日志数据的key值ֵ
  db: 15
  timeout: 5

#-------------------------- Elasticsearch output ------------------------------

output.elasticsearch:

  hosts: ["elasticsearch:9200"]

#----------------------------- Logstash output --------------------------------

output.logstash:

  hosts: ["logstash:5044"]  # ["localhost:5044", "localhost:5045"] 

  loadbalance: true   # 多个负载均衡

  index: filebeat

# loadbalance: true 每一条message都随机负载到一个logstash上

# loadbalance: false 随机选择一个logstash使用，每一次的message都发到同一个logstash，当这个logstash响应变慢的时候，就在选择一个来使用。

========================================================

chmod -R 444  /data/docker/monitor/filebeat/filebeat.conf

kibana:

创建索引模式:  filebeat-7.6.0-*

========================================================

1.安装nginx:

nginx 部署 (+geoip,brotli,ngx_lua_waf,telegraf,filebeat):  https://abc.htmltoo.com/thread-43508.htm

2.安装elasticsearch:

elasticsearch 部署:  https://abc.htmltoo.com/thread-44931.htm

3.安装kibana:

kibana 部署: https://abc.htmltoo.com/thread-44932.htm

2.安装filebeat:

Install Elasticsearch GeoIP and user agent plugins

bin/elasticsearch-plugin install ingest-geoip
bin/elasticsearch-plugin install ingest-user-agent

Download and install Filebeat

cd /home

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.6.0-amd64.deb
dpkg -i filebeat-7.6.0-amd64.deb  # DEB安装

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.6.0-x86_64.rpm
rpm -vi filebeat-7.6.0-x86_64.rpm  # rpm安装

vi /etc/filebeat/filebeat.yml

output.elasticsearch:  # 输出到elasticsearch
  hosts: ["http://file.htmltoo.com:9200"]
  #username: "elastic"
  #password: "<password>"
setup.kibana:
  host: "http://file.htmltoo.com:5601"

Enable and configure the module

filebeat modules enable nginx     # nginx logs
filebeat modules enable apache2   # Apache logs
filebeat modules enable mysql     # Mysql logs
filebeat modules enable redis     # Redis logs
filebeat modules enable system    # System logs

Start Filebeat

filebeat setup
service filebeat stop
service filebeat restart
service filebeat status

================

- type: log

  paths:

      - "/var/log/httpd/*"     # 此处日志位置要注意 我使用的是yum安装的apache

  fields:                               # 可选字段，选择额外的字段进行输出

    filetype: httpd             

  fields_under_root: true 

# 值为ture，fields存储在输出文档的顶级位置; 如与filebeat中字段冲突，自定义字段会覆盖其他字段

# fields:自定义字段

# fields_under_root:为true,则自定义字段将为文档中的顶级字段。

  exclude_lines: ['^DBG']    # 导出那些除了以DGB开头的行

  include_lines: ['^ERR', '^WARN']   # 导出以ERR或者WARN开头的行

#设置删除不必要的字段

processors:         

 - drop_fields:

    fields: [ "ecs","cloud","@version" ]

=========官方=========

filebeat.inputs:

- type: log

  paths:

    - /var/log/system.log

    - /var/log/wifi.log

- type: log

  paths:

    - "/var/log/apache2/*"

  fields:

    apache: true

  fields_under_root: true

https://www.imooc.com/article/23145