filebeat 输出logstash实战案例

1 .logstash 配置：

beats_to_logstash.conf

input {
  # 指定输入端为beats
  beats {
    # 指定监听端口
    port => 8888
  }
}


output { 
  stdout {
    codec => rubydebug 
  } 
}

启动logstash :

logstash -rf /root/config/beats_to_logstash.conf

2 配置 filebeat

log_to_logstash.yaml

[root@baimeidashu-elk111 ~/config]#cat log_to_logstash.yaml 
#指定 input插件的配置
filebeat.inputs:
  # 类型为log
- type: log
  # 指定日志的路径
  paths:
    - /tmp/filebeat/**/*.log

# 将数据发送到logstash
output.logstash:
  hosts: ["10.0.0.113:8888"]

启动 filebeats

filebeat -e -c /root/config/log_to_logstash.yaml

写入测试数据测试：

echo  11111 > /tmp/filebeat/1.log

logstash 收到数据了

推荐阅读:
https://www.elastic.co/guide/en/beats/filebeat/7.17/filtering-and-enhancing-data.html