主要filebeat配置：

filebeat.prospectors:

input_type: log

paths:

/var/log/rsyncd.log

input_type: log

paths:

/var/log/messages

fields:

syslog: messages

fields_under_root: true

#输出到es配置

output.elasticsearch:

hosts: ["10.211.121.75:9200","10.211.121.73:9200","10.211.121.74:9200"]

index: "logstashrsync%{+YYYY.MM.dd}"

indices:

index: "messages-%{+yyyy.MM.dd}"

when.contains:

syslog: messages #通过此处来将message日志写入到message 的index

username: "elastic"

password: "12345"

logging.level: warning