利用Filebeat+ELK 来收集.Net Core 微服务日志 (三）-完

一：建立监控端Filebeat （一台服务器部署一个，作为整个服务器微服务的监控点，这里为什么不使用logstash，原因可以查查Filebeat 与logstash的差别）

Filebeat 这里值 得一提的就是 filebeat.yml 文件：

1：配置每个应用错误 日志文件路径，与合并多行上传给logstash。这里值得注意下

filebeat:
  prospectors:
    -
      paths:
          - /data/logs/*/*/*.err

      input_type: log
      document_type: filebeat-apps-log
      multiline:

        # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
        pattern: ^\[

        # Defines if the pattern set under pattern should be negated or not. Default is false.
        negate: true

        # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
        # that was (not) matched before or after or as long as a pattern is not matched based on negate.
        # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
        match: after


  registry_file: ./registry/mark
output:
  logstash:
    hosts: ["10.0.1.250:5044"]
logging:
  files:
    path: /var/log/filebeat
    rotateeverybytes: 10485760 # = 10MB