Filebeat实例04-使用模块采集es集群日志

ES集群地址

10.0.0.91:9200
10.0.0.92:9200
10.0.0.93:9200

启用模块

root@elk92:~# filebeat modules enable elasticsearch

Filebeat实例

root@elk92:~# vim /etc/filebeat/config/04-modules-tomcat-to-elasticsearch.yaml
filebeat.config.modules:
  path: ${path.config}/modules.d/elasticsearch.yml
  reload.enabled: true

output.elasticsearch:
  hosts:
  - 10.0.0.91:9200
  - 10.0.0.92:9200
  - 10.0.0.93:9200
  index: dezyan-modules-tomcat-%{+yyyy.MM.dd}

setup.ilm.enabled: false
setup.template.name: "dezyan"
setup.template.pattern: "dezyan-*"
setup.template.overwrite: true
setup.template.settings:
  index.number_of_shards: 5
  index.number_of_replicas: 0
  
root@elk92:~# filebeat -e -c /etc/filebeat/config/04-modules-elasticsearch-to-es.yaml