ELK线上系统配置整理-filebeat（一）

filebeat客户端收集日志的配置

使用yum安装的filebeat 配置文件/etc/filebeat/filebeat.yml

Verification code: 
filebeat.prospectors:
- type: log
  enabled: True
  paths:
    - /data/artery/changhong/logs/system.out
  tail_files: true
  multiline:
    pattern: ^\d{4}-\d+-\d+\s+\S+
    match: after
    negate: true
  fields:
    logtype: "Artery"
    HostType: "Changhong-Web01"

- type: log
  enabled: True
  paths:
    - /data/logs/changhong-fore-web.log
  tail_files: true
  multiline:
    pattern: \[[A-Z][A-Z][A-Z][A-Z].(\S+)
    match: after
    negate: true
  fields:
    logtype: "Tomcat-Fore"
    HostType: "Changhong-Web01"

- type: log
  enabled: True
  paths:
    - /data/logs/changhong-back-web.log
  tail_files: true
  multiline:
    pattern: \[[A-Z][A-Z][A-Z][A-Z].(\S+)
    match: after
    negate: true
  fields:
    logtype: "Tomcat-Back"
    HostType: "Changhong-Web01"
output.logstash:
#  hosts: ["172.31.50.91:5044","172.31.5.5:5044"]
  hosts: ["172.31.50.131:5044"]
  loadbalance: true
  bulk_max_size: 1024