Linux 安装filebeat

1、下载并解压

地址：https://www.elastic.co/cn/downloads/beats/filebeat

curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.3.0-linux-x86_64.tar.gz
tar zxvf filebeat-7.3.0-linux-x86_64.tar.gz
mv filebeat-7.3.0-linux-x86_64.tar.gz filebeat

2、配置

cd filebeat
vim filebeat.yml

 enabled:true
 paths:
    - /data/logstash/*
 scan_frequency: 1s
 force_close_files: true
 
输出到logstash设置如下：
output.logstash:
  # The Logstash hosts
  hosts: ["localhost:5044"]

输出到es设置如下：

output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]

3、启动

./filebeat -e -c filebeat.yml

重新读取启动:
 rm -rf data/*
 data里记录着读取文件的位置信息