1、安装

wget https://mirrors.tuna.tsinghua.edu.cn/elasticstack/7.x/yum/7.4.2/filebeat-7.4.2-x86_64.rpm
rpm -ivh filebeat-7.4.2-x86_64.rpm

2、更改配置

filebeat.inputs:


- type: log
  enabled: true
  json.key_under_root: true
  json.overwrite_keys: true
  json.message_key: log
  paths:
    - /www/wwwlogs/activity-vote-api.liaosearch.com.log
  tags: ["nginx_access"]
  fields:
    svcname: nginx
    logtype: nginx_access

output.logstash:
  # The Logstash hosts
  hosts: ["172.26.239.33:5000"]

其他的output全部关闭

3、filebeat启动

systemctl start filebeat
systemctl status filebeat

4、logstash配置

input {
    beats {
        port => 5000
    }

}

## Add your filters / logstash plugins configuration here

output {
    elasticsearch {
        hosts => "elasticsearch:9200"
        user => "elastic"
        password => "你的es密码"
                index=>"nginx-log-%{+YYYY.MM}"   #设置索引名字


    }
}

5、nginx配置

  log_format json  escape=json '{"timestamp": "$time_local",'
        '"remote_addr": "$remote_addr",'
        '"referer": "$http_referer",'
        '"request": "$request",'
        '"statu": "$status",'
        '"byte": "$body_bytes_sent",'
        '"agen": "$http_user_agent",'
        '"x_forwarded": "$http_x_forwarded_for",'
        '"up_resp_time": "$upstream_response_time",'
        '"request_time": "$request_time"}';