Filebeat 采集多个文件到es

主要filebeat配置：

#采集器

filebeat.prospectors:

• input_type: log
  paths:
  • /var/log/rsyncd.log
• input_type: log
  paths:
  • /var/log/messages
    fields:
    syslog: messages
    fields_under_root: true

#输出到es配置
output.elasticsearch:
hosts: ["10.211.121.75:9200","10.211.121.73:9200","10.211.121.74:9200"]
index: "logstashrsync%{+YYYY.MM.dd}"
indices:

• index: "messages-%{+yyyy.MM.dd}"
  when.contains:
  syslog: messages #通过此处来将message日志写入到message 的index

  username: "elastic"
  password: "12345"

logging.level: warning

转载于:https://blog.51cto.com/devops9527/2087743