Filebeat实例08-使用模块采集MongoDB日志

ES集群地址

10.0.0.91:9200
10.0.0.92:9200
10.0.0.93:9200

启用模块

root@elk92:~# filebeat modules enable mongodb

修改模块配置文件

#由于是采用二进制部署的MySQL，所以要制定日志目录
root@elk93:~# vim /etc/filebeat/modules.d/mongodb.yml

# Module: mongodb
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.17/filebeat-module-mongodb.html

- module: mongodb
  # All logs
  log:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/mongodb/log/*.log"]

Filebeat实例

root@elk92:~# vim /etc/filebeat/config/08-modules-mongodb-to-es.yaml
filebeat.config.modules:
  path: ${path.config}/modules.d/mongodb.yml
  reload.enabled: true

output.elasticsearch:
  hosts:
  - 10.0.0.91:9200
  - 10.0.0.92:9200
  - 10.0.0.93:9200
  index: dezyan-modules-mongodb-%{+yyyy.MM.dd}

setup.ilm.enabled: false
setup.template.name: "dezyan"
setup.template.pattern: "dezyan-*"
setup.template.overwrite: true
setup.template.settings:
  index.number_of_shards: 5
  index.number_of_replicas: 0
  
root@elk92:~# filebeat -e -c /etc/filebeat/config/08-modules-mongodb-to-es.yaml