filebeat 的部署文件

filebeat.inputs:- type: log enabled: true paths: - D:\bb\smallpaper\*.txt fields: index: smallpaper- type: log enabled: true paths: - D:\bb\bookauthor\*.txt fields: index: bookauthor# 自定义ES的索引需要把ilm设置为falsesetup.ilm.enabled: falseoutput.elasticsearch: hosts: ["es的ip:9200"] username: "账号" password: "密码" indices: - index: "qyx-smallpaper" when.equals: fields: index: "smallpaper" - index: "qyx-bookauthor" when.equals: fields: index: "bookauthor"

filebeat.yaml 测试配置

filebeat.inputs:- type: filestream enabled: true paths: - /var/log/*.log- type: log enable: true paths: - /var/log/es.log# json.keys_under_root: true# json.overwrite_keys: true fields: index: esfilebeat.config.modules: path: ${path.config}/modul/*.yml reload.enabled: true setup.ilm.enabled: false # 自定义索引必须要配置的一个参数#setup.template.name: "es-web-log"#setup.template.pattern: "es-*"#setup.template.overwrite: true#setup.template.enabled: true#setup.template.settings:# index.number_of_shards: 1setup.kibana: host: "node2:5601"output.elasticsearch: hosts: ["node1:9200"]# index: "es-%{[fields.index]}-*" indices: - index: "es-%{+yyyy-MM-dd}" when.equals: fields: index: "es" username: "elastic" password: "Meng@2"#processors:# - add_host_data:# when.not.contains.tags: forwar# - add_cloud_meta: ~# - add_docker_meta: ~# - add_kubernetes_meta: ~