Filebeat收集單個日誌&json格式
阿新 • • 發佈:2020-08-22
1.配置收集日誌到檔案
[root@web01 ~]# vim /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
enable: true
paths:
- /var/log/nginx/access.log
output.file:
path: "/tmp"
filename: "filebeat.log"
2.配置收集日誌到ES
[root@web01 ~]# vim /etc/filebeat/filebeat.yml filebeat.inputs: - type: log enable: true paths: - /var/log/nginx/access.log output.elasticsearch: hosts: ["10.0.0.51:9200"]
3.配置收集日誌為json格式
1)配置
#由於收集日誌內容還是寫到了message,沒有辦法作圖
[root@web01 ~]# vim /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
enable: true
paths:
- /var/log/nginx/access.log
json.keys_under_root: true
json.overwrite_keys: true
output.elasticsearch:
hosts: ["10.0.0.51:9200"]
2)修改Nginx日誌格式
#filebeat只支援某種json格式寫法 [root@web01 ~]# vim /etc/nginx/nginx.conf ... ... log_format log_json '{ "time_local": "$time_local", ' '"remote_addr": "$remote_addr", ' '"referer": "$http_referer", ' '"request": "$request", ' '"status": $status, ' '"bytes": $body_bytes_sent, ' '"agent": "$http_user_agent", ' '"x_forwarded": "$http_x_forwarded_for", ' '"up_addr": "$upstream_addr",' '"up_host": "$upstream_http_host",' '"upstream_time": "$upstream_response_time",' '"request_time": "$request_time" }'; ... ...
3)重啟
1.重啟Nginx
2.重啟Filebeat
3.刪除原來的索引
4.清空Nginx日誌