journalbeat收集系统日志

journalbeat: 读取journald日志，journalctl命令看到的日志都收集了

本文采取的是将日志存到redis(也可以logstash kafka es),然后logstash从redis取数据

logstash往redis里面取这个步骤就省略了

下载二进制包:
https://github.com/mheese/journalbeat/releases
journalbeat地址: https://github.com/mheese/journalbeat.

配置文件参考源码包里的etc目录下的:journalbeat.yml

例如:journalbeat.yml

journalbeat:
name:
output.redis:
enabled: true
hosts: ["172.16.1.200"]
port: 6379
key: systemd_log  #写入到redis的key
logging.level: debug
logging.to_files: true
logging.files:

创建相关目录

mkdir /etc/journalbeat   /data/journalbeat/home /data/log/journalbeat  /data/journalbeat/data
cp journalbeat /usr/local/bin/

加入开机启动

cat /lib/systemd/system/journalbeat.service

[Unit]
Description = journalbeat service
Documentation = https://github.com/mheese/journalbeat/blob/master/README.md
Wants = network-online.target
After = network-online.target
[Service]
User = root
Group = root
Type = simple
ExecReload = /bin/kill -HUP $MAINPID
ExecStart = /usr/local/bin/journalbeat -c /etc/journalbeat/journalbeat.yml -path.home /data/journalbeat/home -path.config /etc/journalbeat -path.data /data/journalbeat/data -path.logs /data/log/journalbeat
BlockIOAccounting = True
CPUAccounting = True
MemoryAccounting = True
TasksAccounting = True
PrivateDevices = False
PrivateNetwork = False
PrivateTmp = True
PrivateUsers = True
Restart = on-failure
RestartSec = 2
Slice = system.slice
TimeoutSec = 120
[Install]
WantedBy = multi-user.target

启动服务

systemctl daemon-reload
systemctl  restart  journalbeat.service

参考文档 https://zhuanlan.zhihu.com/p/29515184
systems参考文档 http://www.ruanyifeng.com/blog/2016/03/systemd-tutorial-commands.html