filebeat.yml模板

nginx

<code>log_format elk 'nginx-$http_host [$time_iso8601] $remote_addr $remote_user $scheme $uri $request_method "$query_string" "$request_body" $body_bytes_sent $status $http_x_real_ip $http_x_forwarded_for $upstream_addr $upstream_status $http_trace_id $http_span_id $request_time $upstream_response_time $http_referer $http_user_agent';/<code>

業務機通用

<code>filebeat.inputs:
#-----------------------------------------------------------------
- type: log
enabled: true
paths:
- /data/logs/user_center/*/*.log
- /data/logs/common_service/*/*.log
#- /var/log/*.log
#- c:\\programdata\\elasticsearch\\logs\\*
multiline.pattern: ^\\[
multiline.negate: true
multiline.match: after
#-----------------------------------------------------------------
- type: log
enabled: true
paths:
- /var/log/nginx/usercenterapi/access.log
- /var/log/nginx/commonapi/access.log
#-----------------------------------------------------------------
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: true
#-----------------------------------------------------------------
setup.template.settings:
index.number_of_shards: 1
#-----------------------------------------------------------------
setup.kibana:
#-----------------------------------------------------------------
output.kafka:
hosts: ["172.19.220.161:9092"]
topic: xmw-php-logs
partition.round_robin:
reachable_only: false
required_acks: 1
compression: gzip
max_message_bytes: 1000000
#-----------------------------------------------------------------
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
#-----------------------------------------------------------------
logging.level: info
logging.to_files: true
logging.to_syslog: false
#-----------------------------------------------------------------
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 2
logging.selectors: ["*"]/<code>

前端分發機器nginx環境

<code>#----------------------------------------------------------------------------------------------------
filebeat.inputs:
#-----------------------------------
- type: log
enabled: true
json.keys_under_root: true
json.overwrite_keys: true
paths:
- /var/log/nginx/courseapi/access.log
- /var/log/nginx/worldapi/access.log
- /var/log/nginx/usercenterapi/access.log
- /var/log/nginx/commonapi/access.log
fields:
log_topics: xmw-php-logs
#-----------------------------------
- type: log
enabled: true
json.keys_under_root: true
json.overwrite_keys: true
paths:
- /var/log/nginx/world/access.log
fields:
log_topics: shequ-nginx
#----------------------------------------------------------------------------------------------------
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
#----------------------------------------------------------------------------------------------------
setup.template.settings:
index.number_of_shards: 1
#----------------------------------------------------------------------------------------------------
setup.kibana:
#----------------------------------------------------------------------------------------------------
output.kafka:
hosts: ["172.19.220.161:9092"]
#topic: product-nginx-worldapi
topic: '%{[fields][log_topics]}'
partition.round_robin:
reachable_only: false
required_acks: 1
compression: gzip
max_message_bytes: 1000000
#----------------------------------------------------------------------------------------------------
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
/<code>

閱讀更多 ethnicity 的文章

關鍵字: Nginx Scheme 模板