filebeat

官网

官方文档

filebeat-input-docker

Manage multiline messages

Regular expression support

Add Kubernetes metadata

1. filebeat 可以做什么

2. filebeat 安装

# 安装 es
docker pull docker.elastic.co/elasticsearch/elasticsearch:6.2.4

/sbin/sysctl -w vm.max_map_count=262144

docker stop elasticsearch && docker rm elasticsearch 

docker run -d --name elasticsearch --restart=always -p 9200:9200 -p 9300:9300 \
  --ulimit nofile=65536:65536 --ulimit memlock=-1:-1 \
  -e "bootstrap.memory_lock=true" \
  -e "discovery.type=single-node" \
  -e "ES_JAVA_OPTS=-Xms4g -Xmx4g" \
  docker.elastic.co/elasticsearch/elasticsearch:6.5.4

# 检查 es 健康状态：
curl http://127.0.0.1:9200/_cat/health

# 安装 kibana
docker stop kibana && docker rm kibana

docker run -d --name kibana --restart=always -p 30561:5601 \
  -e "ELASTICSEARCH_URL=http://10.68.0.7:9200" \
  docker.elastic.co/kibana/kibana:6.5.4

# 安装 filebeat
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.5.4-x86_64.rpm
rpm -Uvh filebeat-6.5.4-x86_64.rpm
systemctl restart filebeat

3. 常用命令

# 查看启用和禁用模块列表
filebeat modules list

4. 参考资料

Filebeat 快速开始

Elastic 技术栈之 Filebeat

ELK--filebeat详解