先貼一下官方文檔https://www.elastic.co/guide/en/beats/filebeat/6.6/filebeat-installation.html

我本次使用rpm的方式安裝,與官方文檔略有差異,記錄如下:

//官方是使用curl命令:curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.6.1-x86_64.rpm

//但是我所用的服務器可能做了限制(報curl: (35) SSL connect error),我使用wget代替,下載到服務器上,如下

wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.6.1-x86_64.rpm

sudo rpm -vi filebeat-6.6.1-x86_64.rpm

配置input

　　安裝成功之後,配置文件的路經在/etc/filebeat/filebeat.yml,直接使用vimfilebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

 
- type: log
　# 默認為false,需要把enabled改為true
  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
　　# 日誌文件所在目錄
    - /var/log/*.log
    #- D:\data\logs\*

配置output.elasticsearch

output.elasticsearch:
  # Array of hosts to connect to.
 
　# 輸出至目的elasticsearch
  hosts: ["localhost:9200"]

重啟filebeat

 service filebeat restart

cent os安裝filebeat