下載地址

Windows：https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-6.5.4-windows-x86_64.zip

Linux：      https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-6.5.4-x86_64.rpm

                  https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-6.5.4-linux-x86_64.tar.gz

安裝 metricbeat 6.5（Linux）

[[email protected] ~]# cd /opt/software/
[[email protected] software]# rpm -ivh metricbeat-6.5.3-x86_64.rpm 
warning: metricbeat-6.5.3-x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY
Preparing...                          ################################# [100%]
Updating / installing...
   1:metricbeat-6.5.3-1               ################################# [100%]

安裝 metricbeat 6.5（Windows）

以服務的方式安裝執行

啟動服務

配置 metricbeat 6.5

• Linux

[[email protected] metricbeat]# ls
fields.yml  metricbeat.reference.yml  metricbeat.yml  modules.d
[[email protected] metricbeat]# vi metricbeat.yml
# 輸出為elasticsearch的配置
metricbeat.config.modules:
  path: /etc/metricbeat/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
setup.kibana:
   host: "http://10.10.10.34:5601"
setup.dashboards.enabled: true
output.elasticsearch:
   hosts: ["http://es-master1.linuxplus.com:9200", "http://es-master2.linuxplus.com:9200"]
# 輸出為kafka的配置
metricbeat.config.modules:
  path: /etc/metricbeat/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
setup.kibana:
   host: "http://10.10.10.34:5601"
setup.dashboards.enabled: true
output.kafka:
   enabled: true
   hosts: ["kafka1.linuxplus.com:9092","kafka2.linuxplus.com:9092","kafka3.linuxplus.com:9092"]
   topic: '%{[fields][service]}'
fields:
  service: metricbeat   
[
 
[email protected] metricbeat]# cd modules.d/
[[email protected] modules.d]# vim system.yml
# Module: system
# Docs: https://www.elastic.co/guide/en/beats/metricbeat/6.5/metricbeat-module-system.html

- module: system
  period: 10s
  metricsets:
    - cpu
    - load
    - memory
    - network
    - process
    - process_summary
    #- core
    - diskio
    - socket
  process.include_top_n:
    by_cpu: 5      # include top 5 processes by CPU
    by_memory: 5   # include top 5 processes by memory

- module: system
  period: 1m
  metricsets:
    - filesystem
    - fsstat
  processors:
  - drop_event.when.regexp:
      system.filesystem.mount_point: '^/(sys|cgroup|proc|dev|etc|host|lib)($|/)'

- module: system
  period: 15m
  metricsets:
    - uptime

#- module: system
#  period: 5m
#  metricsets:
#    - raid
#  raid.mount_point: '/'   
[[email protected] metricbeat]# metricbeat setup --dashboards
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards
[[email protected] metricbeat]# /usr/share/metricbeat/bin/metricbeat test config
Config OK
[[email protected] metricbeat]# /etc/init.d/metricbeat start
Starting metricbeat (via systemctl):                       [  OK  ]

• Windows

metricbeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
fields:
  service: metricbeat
setup.dashboards.enabled: true
setup.kibana:   
  host: "http://10.10.10.34:5601"
output.kafka:
   enabled: true
   hosts: ["kafka1.linuxplus.com:9092","kafka2.linuxplus.com:9092","kafka3.linuxplus.com:9092"]
   topic: '%{[fields][service]}'

配置 Logstash6.5 (關鍵配置)

[[email protected] conf.d]# vim logstash.conf
input {
  kafka {
       bootstrap_servers => "kafka1.linuxplus.com:9092,kafka2.linuxplus.com:9092,kafka3.linuxplus.com:9092"
       topics => ["nginx-access","nginxtcp","nginxerror","windows","metricbeat"]
       consumer_threads => "10"
       codec => "json"   
   }
}
.....
output {
if [fields][service] == "metricbeat" {
    elasticsearch {
      hosts => ["es-master1.linuxplus.com:9200","es-master2.linuxplus.com:9200"]
      index => "metricbeat-6.5.3-%{+YYYY.MM.dd}"
    }
}