Filebeat实例02-使用模块采集nginx日志

ES集群地址

10.0.0.91:9200
10.0.0.92:9200
10.0.0.93:9200

启用模块

root@elk92:~# filebeat modules enable nginx

编辑nginx模块配置

root@elk92:~# vim /etc/filebeat/modules.d/nginx.yml
- module: nginx
  access:
    enabled: true
    var.paths: ["/var/log/nginx/access.log*"]
  error:
    enabled: false
  ingress_controller:
    enabled: false

Filebeat实例

root@elk92:~# vim /etc/filebeat/config/02-modules-nginx-to-es.yaml
# 配置模块功能
filebeat.config.modules:
  path: ${path.config}/modules.d/nginx.yml
  # 是否支持热加载
  reload.enabled: true

output.elasticsearch:
  hosts:
  - 10.0.0.91:9200
  - 10.0.0.92:9200
  - 10.0.0.93:9200
  index: dezyan-modules-nginx-%{+yyyy.MM.dd}

setup.ilm.enabled: false
setup.template.name: "dezyan"
setup.template.pattern: "dezyan-*"
setup.template.overwrite: true
setup.template.settings:
  index.number_of_shards: 5
  index.number_of_replicas: 0
  
root@elk92:~# filebeat -e -c /etc/filebeat/config/02-modules-nginx-to-es.yaml