•filebeat安裝與配置
–使用rpm 安裝filebeat
rpm -ivhfilebeat-1.2.3-x86_64.rpm
–修改配置檔案/etc/filebeat/filebeat.yml
–設定開機執行
[root@logstash] systemctlenable filebeat
–開啟服務
[root@logstash] systemctlstart filebeat
配置filebeat 特別簡單如下
[root@logstash ]# vim /etc/logstash/logstash.conf
input{
。。。。。。
beats{
port => 5044
}
。。。。。

然後部署客戶端來到apache伺服器，我們的Apache在kabana伺服器上
[root@logstash patterns]# ssh 192.168.0.16
[root@kibana ~]# yum -y install filebeat-1.2.3-x86_64.rpm
[root@kibana ~]# vim /etc/filebeat/filebeat.yml
15 - /var/log/httpd/access_log
72 document_type: apachelog
183 # elasticsearch: 註釋掉
188 # hosts: ["localhost:9200"] 註釋掉
278 logstash:
280 hosts: ["182.168.0.18:5044"]
[root@kibana ~]# grep -Pv "^\s*(#|$)" /etc/filebeat/filebeat.yml
filebeat:
prospectors:
-
paths:
- /var/log/httpd/access_log
input_type: log
document_type: apachelog
registry_file: /var/lib/filebeat/registry
output:
logstash:
hosts: ["182.168.0.18:5044"]
shipper:
logging:
files:
rotateeverybytes: 10485760 # = 10MB
[root@kibana ~]# systemctl start filebeat.service
[root@kibana ~]# systemctl enable filebeat.service