filebeat的配置文件
filebeat.config:
modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
processors:
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_host_metadata: ~
filebeat.inputs:
- type: docker
combine_partial: false
containers:
path: “/var/lib/docker/containers”
json.keys_under_root: true
ids:
- “*”
fields:
logtopic: docker
setup.template.settings:
index.number_of_shards: 3
setup.kibana:
setup.template.name: “app”
setup.template.pattern: “app-*”
setup.template.overwrite: true
setup.template.enabled: false
setup.ilm.enabled: false
output.elasticsearch:
hosts: [“172.30.149.181:9200”,“172.30.149.182:9200”,“172.30.149.183:9200”]
indices:
- index: “test-sec-%{+yyyy.MM}”
when.equals:
fields:
logtopic: “syslog”
- index: “test-app-%{+yyyy.MM}”
when.equals:
fields:
logtopic: “docker”
或者是采用自动发现
filebeat.config:
modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
filebeat.autodiscover:
providers:
- type: docker
hints.enabled: true
hints.default_config.enabled: false
exclude: [“filebeat”]
setup.template.settings:
index.number_of_shards: 3
setup.kibana:
setup.template.name: “bss-app”
setup.template.pattern: “bss-app*”
setup.template.overwrite: true
setup.template.enabled: false
setup.ilm.enabled: false
output.elasticsearch:
hosts: [“172.30.149.18:9200”]
index: “bss-app-%{+yyyy.MM}”
processors:
- add_host_metadata: ~
- add_docker_metadata: ~
- drop_event:
when:
equals:
docker.container.name: “filebeat”