filebeat 配置多日志同步到es

1.下载filebeat  和es 想对应的版本

   下载地址：https://www.elastic.co/cn/downloads/past-releases#filebeat

2.将filebeat.yml 里边全部清空  添加配置

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - D:\bb\smallpaper\*.txt
  fields:
    index: smallpaper

- type: log
  enabled: true
  paths:
     -  D:\bb\bookauthor\*.txt
  fields:
    index: bookauthor

# 自定义ES的索引需要把ilm设置为false
setup.ilm.enabled: false

output.elasticsearch:
  hosts: ["es的ip:9200"]
  username: "账号"
  password: "密码" 
  indices:
    - index: "qyx-smallpaper"
      when.equals:
        fields:
          index: "smallpaper"
    - index: "qyx-bookauthor"
      when.equals:
        fields:
          index: "bookauthor"

 

3.控制台运行 filebeat

  cmd 到根目录  ，然后  filebeat  -e -c  myfilebeat.yml

4.将filebeat以windows服务的形式运行  

   找到install-service-filebeat.ps1   右键 用powershell 运行