这里的配置文件如下#filebeat.yml
#filebeat.yml
filebeat.inputs:
- type: log
#enabled: true
paths:
#文件目录
- /data/gxpt/pfme-tsdb/log/*.log
fields_under_root: true
#添加字段用于判断存入哪个索引
fields:
log_topics: "opentsdb"
- type: log
#enabled: true
paths:
- /data/gxpt/dataservice/log/*.log
fields_under_root: true
fields:
log_topics: "dataservice"
- type: log
#enabled: true
paths:
- /data/gxpt/dataway-apiauto/logs/*.log
fields_under_root: true
fields:
log_topics: "dataway"
processors:
- drop_fields:
fields: ["ecs","agent","host","input"]
logging:
files:
rotateeverybytes: 10485760
output.elasticsearch:
#es的地址
hosts: ["172.16.164.126:19200"]
indices:
#按天建立索引
- index: "opentsdb-%{+yyyy.MM.dd}"
#当满足下面条件的日志存入
when.contains:
log_topics: "opentsdb"
- index: "dataservice-%{+yyyy.MM.dd}"
when.contains:
log_topics: "dataservice"
- index: "dataway-%{+yyyy.MM.dd}"
when.contains:
log_topics: "dataway"
#模板名
setup.template.name: "opentsdb"
#模板匹配
setup.template.pattern: "opentsdb-*"
setup.template.enabled: true
setup.template.overwrite: true
setup.ilm.enabled: false
setup.template.name: "dataservice"
setup.template.pattern: "dataservice-*"
setup.template.enabled: true
setup.template.overwrite: true
setup.ilm.enabled: false
setup.template.name: "dataway"
setup.template.pattern: "dataway-*"
setup.template.enabled: true
setup.template.overwrite: true
setup.ilm.enabled: false
下面在kibana的上面按照之前一样配置
这里的名称对应filebeat配置文件中的 setup.template.pattern
至此索引建立成功
