filebeat.yml配置文件参数
在source里加入了一个fields叫做“appach: true"。
filebeat.inputs:
- type: log
enabled: true
fields: # 注意这两行
apache: true
paths:
- /apache-daily-access.log
output.elasticsearch:
hosts: ["localhost:9200"]
显示结果：
{
"_index" : "filebeat-7.3.0-2019.09.11-000001",
"_type" : "_doc",
"_id" : "637VIG0BJD_DqHjgqvC5",
"_score" : 1.0,
"_source" : {
"@timestamp" : "2019-09-11T14:58:55.902Z",
"message" : """144.228.123.71 - - [11/Sep/2019:01:52:35 +0000] "GET /category/games HTTP/1.1" 200 117 "/search/?c=Books+Software" "Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11"""",
"input" : {
"type" : "log"
},
"fields" : { # 注意这两行
"apache" : true
},
"ecs" : {
"version" : "1.0.1"
},
"host" : {
"name" : "localhost"
},
"agent" : {
"hostname" : "localhost",
"id" : "c88813ba-fdea-4a98-a0be-468fb53566f3",
"version" : "7.3.0",
"type" : "filebeat",
"ephemeral_id" : "ec3328d6-f7f0-4134-a2b6-8ff0c5141cc5"
},
"log" : {
"offset" : 300352,
"file" : {
"path" : "/Users/liuxg/data/apache-daily-access.log"
}
}
}
}
也可以加入一些tags：
filebeat.inputs:
- type: log
enabled: true
fields:
apache: true
tags: ["my-service", "hardware", "test"] # 注意这一行
paths:
- /Users/liuxg/data/apache-daily-access.log
output.elasticsearch:
hosts: ["localhost:9200"]
这样在_source里就会出现一些tag:
{
"_index" : "filebeat-7.3.0-2019.09.11-000001",
"_type" : "_doc",
"_id" : "HIHyIG0BJD_DqHjgm0uL",
"_score" : 1.0,
"_source" : {
"@timestamp" : "2019-09-11T15:30:33.163Z",
"agent" : {
"id" : "c88813ba-fdea-4a98-a0be-468fb53566f3",
"version" : "7.3.0",
"type" : "filebeat",
"ephemeral_id" : "6fc482b2-fac8-4d79-8ca1-b27ef39cea3d",
"hostname" : "localhost"
},
"log" : {
"file" : {
"path" : "/Users/liuxg/data/apache-daily-access.log"
},
"offset" : 11497
},
"message" : """164.51.31.185 - - [11/Sep/2019:00:04:15 +0000] "GET /item/giftcards/232 HTTP/1.1" 200 130 "/category/electronics" "Mozilla/5.0 (Windows NT 6.0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11"""",
"tags" : [ # 注意这几行
"my-service",
"hardware",
"test"
],
"input" : {
"type" : "log"
},
"fields" : {
"apache" : true
},
"ecs" : {
"version" : "1.0.1"
},
"host" : {
"name" : "localhost"
}
}
}
