Filebeat实例05-使用模块采集MySQL日志

ES集群地址

10.0.0.91:9200
10.0.0.92:9200
10.0.0.93:9200

启用模块

root@elk92:~# filebeat modules enable mysql

修改模块配置文件

#由于是采用二进制部署的MySQL，所以要制定日志目录
root@elk93:~# vim /etc/filebeat/modules.d/mysql.yml
- module: mysql
  error:
    enabled: true
    var.paths: ["/var/lib/mysql/elk93.err"]
  slowlog:
    enabled: true

Filebeat实例

root@elk92:~# vim /etc/filebeat/config/05-modules-mysql-to-es.yaml
filebeat.config.modules:
  path: ${path.config}/modules.d/mysql.yml
  reload.enabled: true

output.elasticsearch:
  hosts:
  - 10.0.0.91:9200
  - 10.0.0.92:9200
  - 10.0.0.93:9200
  index: dezyan-modules-mysql-%{+yyyy.MM.dd}

setup.ilm.enabled: false
setup.template.name: "dezyan"
setup.template.pattern: "dezyan-*"
setup.template.overwrite: true
setup.template.settings:
  index.number_of_shards: 5
  index.number_of_replicas: 0
  
root@elk92:~# filebeat -e -c /etc/filebeat/config/05-modules-mysql-to-es.yaml