在Ubuntu上配置Filebeat多实例,你需要为每个实例创建单独的配置文件和数据目录。以下是配置多实例的步骤:
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
sudo apt-get update && sudo apt-get install filebeat
请注意,你需要将7.x替换为你正在使用的Elasticsearch版本。
filebeat-instance1.yml和filebeat-instance2.yml。在/etc/filebeat.d/目录下创建这两个文件:sudo nano /etc/filebeat.d/filebeat-instance1.yml
sudo nano /etc/filebeat.d/filebeat-instance2.yml
filebeat.inputs,filebeat.modules,output.elasticsearch等部分的路径。例如:filebeat-instance1.yml:
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/instance1/*.log
filebeat.config.modules:
path: ${config.home}/modules.d/*.yml
reload.enabled: false
output.elasticsearch:
hosts: ["localhost:9200"]
index: "instance1-%{+yyyy.MM.dd}"
setup.template.name: "instance1"
setup.template.pattern: "instance1-*"
setup.template.enabled: false
logging.to_files:
enabled: true
path: /var/log/filebeat-instance1
name: filebeat-instance1
keepfiles: 7
filebeat-instance2.yml:
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/instance2/*.log
filebeat.config.modules:
path: ${config.home}/modules.d/*.yml
reload.enabled: false
output.elasticsearch:
hosts: ["localhost:9200"]
index: "instance2-%{+yyyy.MM.dd}"
setup.template.name: "instance2"
setup.template.pattern: "instance2-*"
setup.template.enabled: false
logging.to_files:
enabled: true
path: /var/log/filebeat-instance2
name: filebeat-instance2
keepfiles: 7
sudo mkdir /var/lib/filebeat-instance1
sudo mkdir /var/log/filebeat-instance1
sudo mkdir /var/lib/filebeat-instance2
sudo mkdir /var/log/filebeat-instance2
sudo filebeat -e -c /etc/filebeat.d/filebeat-instance1.yml -d "*"
sudo filebeat -e -c /etc/filebeat.d/filebeat-instance2.yml -d "*"
现在,你已经成功配置了两个Filebeat实例。你可以根据需要创建更多的实例,只需为每个实例创建单独的配置文件和数据目录,并按照上述步骤进行配置。