ELK日志分析平台之filebeat读取日志

1 软件环境说明

本次安装部署所用的软件均为官网上目前的最新版本。

操作系统

软件

Java环境

windows 10

logstash-6.2.4 

jdk 1.8.0_171

filebeat-6.3.0


1.1     filebeat安装(注意:先配置好文件后不要启动,需要先启动logstash,否则输出连接不上会报错)

a.       解压filebeat--6.3.0.zip到自定义路径下

b.  进入filebeat文件夹,找到filebeat.yml,对其进行输入输出配置;

    其中,输入配置如下:(注意,enable应配置为true,让配置文件生效,路径指向你要搜集的日志路径,可以配多个)

#=========================== Filebeat inputs =============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to   true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - D:\APP_Center\workspace\eclipse\ELK_Log\log\*.log
    #- /var/log/*.log
    #- c:\programdata\elasticsearch\logs\*   

    输出配置如下:(将默认的elasticsearch输出注释掉,重新配置logstash,其他配置均为默认即可)

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["127.0.0.1:5044"]

1.2   Logstash安装

a. 解压logstash-6.2.4.zip到自定义路径下;

b.       进入bin目录下,新定义一个配置文件:logstash-simple.conf(名称可自定义),输入来自filebeat,这里采取最简单的标准输出;

input { 
	beats{
		host => "127.0.0.1"
		port => 5044	
		type => "log4j"
	}
}
output {
	stdout{
		codec => rubydebug
	}
}


1.3    启动

a.     先启动logstash ,  进入windows的cmd窗口,使用命令进入配置文件所在的bin目录,启动logstash;

logstash –f logstash-simple.conf

    看到如下输出,则代表启动成功。

Sending Logstash's logs to D:/logstash-6.2.4/logs which is now configured via log4j2.properties
[2018-07-04T11:08:37,244][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"D:/logstash-6.2.4/modules/fb_apache/configuration"}
[2018-07-04T11:08:37,279][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"D:/logstash-6.2.4/modules/netflow/configuration"}
[2018-07-04T11:08:37,565][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2018-07-04T11:08:38,413][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.2.4"}
[2018-07-04T11:08:39,318][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[2018-07-04T11:08:51,885][INFO ][logstash.pipeline        ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[2018-07-04T11:08:53,823][INFO ][logstash.inputs.beats    ] Beats inputs: Starting input listener {:address=>"127.0.0.1:5044"}
[2018-07-04T11:08:53,928][INFO ][logstash.pipeline        ] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#"}
[2018-07-04T11:08:54,028][INFO ][org.logstash.beats.Server] Starting server on port: 5044
[2018-07-04T11:08:54,183][INFO ][logstash.agent           ] Pipelines running {:count=>1, :pipelines=>["main"]}

b.  再启动filebeat,进入windows的cmd窗口,再进入对应的路径,输入启动命令:(也可以同时按住Ctrl+shift再右键打开powershell窗口)

filebeat.exe -e -c filebeat.yml
c.   看到下面的界面则表示启动成功;

ELK日志分析平台之filebeat读取日志_第1张图片

3.  如果产生日志时,logstash就会有标准输出。

ELK日志分析平台之filebeat读取日志_第2张图片


你可能感兴趣的:(ELK+redis,日志分析平台)