2020-06-24-通过 rpm 的方式安装 Filebeat

https://hacpai.com/article/1588145447021#3-2-%E9%85%8D%E7%BD%AEFilebeat

安装 Filebeat

这里我们通过 rpm 的方式下载 Filebeat，注意这里下载和我们 ELK 对应的版本（ELK 是 7.6.1，这里也是下载 7.6.1，避免出现错误）：

wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.6.1-x86_64.rpm
rpm -ivh filebeat-7.6.1-x86_64.rpm

注意：推荐迅雷下载，然后用 scp 上传到 Linux 主机上

配置 Filebeat

这里我们需要告诉 Filebeat 要监控哪些日志文件 及 将日志发送到哪里去，因此我们需要修改一下 Filebeat 的配置：

nano /etc/filebeat/filebeat.yml

要修改的内容为：

-（1）监控哪些日志？

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

\ # Change to true to enable this input configuration.
enabled: true

# Paths that should be crawled and fetched. Glob based paths.
paths:
- /var/lib/docker/containers//.log

这里指定 paths：/var/lib/docker/containers//.log，另外需要注意的是将 enabled 设为 true。

（2）将日志发到哪里？

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["192.168.4.31:9200"]

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"

这里指定直接发送到 Elasticsearch，配置一下 ES 的接口地址即可。

注意：如果要发到 Logstash，请使用后面这段配置，将其取消注释进行相关配置即可：

#----------------------------- Logstash output --------------------------------
#output.logstash:
  # The Logstash hosts
  #hosts: ["localhost:9200"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

启动 Filebeat

由于 Filebeat 在安装时已经注册为 systemd 的服务，所以只需要直接启动即可：

systemctl start filebeat
设置开机启动：

systemctl enable filebeat
检查 Filebeat 启动状态：

systemctl status filebeat

上述操作总结为脚本为：

wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.6.1-x86_64.rpm
rpm -ivh filebeat-7.6.1-x86_64.rpm
echo "请输入elk主机地址 "
read host_ip

sed -i "s/  enabled: false/  enabled: true/g" /etc/filebeat/filebeat.yml
sed -i "s/\/var\/log\/\*.log/\/var\/lib\/docker\/containers\/\*\/\*.log/g" /etc/filebeat/filebeat.yml
sed -i "s/localhost:9200/${host_ip}:9200/g" /etc/filebeat/filebeat.yml

systemctl start filebeat
systemctl enable filebeat
systemctl status filebeat