主要filebeat配置:
filebeat.prospectors:
input_type: log
paths:
/var/log/rsyncd.log
input_type: log
paths:
/var/log/messages
fields:
syslog: messages
fields_under_root: true
#输出到es配置
output.elasticsearch:
hosts: ["10.211.121.75:9200","10.211.121.73:9200","10.211.121.74:9200"]
index: "logstashrsync%{+YYYY.MM.dd}"
indices:
index: "messages-%{+yyyy.MM.dd}"
when.contains:
syslog: messages #通过此处来将message日志写入到message 的index
username: "elastic"
password: "12345"
logging.level: warning
网友评论