一、下载

https://www.elastic.co/cn/downloads/beats/filebeat

image.png

二、修改配置

下载完后，解压，打开filebeat.yml文件

• 修改filebeat.inputs 为以下内容，其中paths为项目的日志路径

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - F:\code\pscp-platform\logs\application\*\*.log
    #- c:\programdata\elasticsearch\logs\*

  # Exclude lines. A list of regular expressions to match. It drops the lines that are
  # matching any regular expression from the list.
  exclude_lines: ['\sDEBUG\s\d']

  # Include lines. A list of regular expressions to match. It exports the lines that are
  # matching any regular expression from the list.
  #include_lines: ['^ERR', '^WARN']

  # Exclude files. A list of regular expressions to match. Filebeat drops the files that
  # are matching any regular expression from the list. By default, no files are dropped.
  exclude_files: ['pscp-boot-admin.*.log$']

  # Optional additional fields. These fields can be freely picked
  # to add additional information to the crawled log files for filtering
  fields:
  #  level: debug
  #  review: 1
    docType: sys-log
    project: pscp-platform

  ### Multiline options

  # Multiline can be used for log messages spanning multiple lines. This is common
  # for Java Stack Traces or C-Line Continuation

  # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
  multiline:
    pattern: '^\[\S+:\S+:\d{2,}] '
    negate: true
    match: after

• 修改output.logstash为以下内容，其中hosts为logstash的部署地址

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["localhost:5044"]
  bulk_max_size: 2048

三、启动

./filebeat -c filebeat.yml -e