Filebeat收集Nginx日志

​​下载地址​​

1、查看Filebeat支持模块

./filebeat modules list

2、启动Nginx模块

启动命令：./filebeat modules enable

3、查看modules.d目录中的文件，可以看到nginx.yml配置文件，证明nginx module模块已开启

ls

4、配置modules.d/nginx.yml文件，指定access.log 和 error.log 的地址

vim

# Module: nginx
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-module-nginx.html

- module: nginx
  # Access logs
  access:
    enabled: true
    var.paths: ["/data/logs/nginx-1.16.1/access.log"]

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

  # Error logs
  error:
    enabled: true
    var.paths: ["/data/logs/nginx-1.16.1/error.log"]

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

5、配置test-nginx.yml文件

# 自定义测试配置文件test-nginx.yml

# 输入
filebeat.inputs:

# 指定索引的分区数
setup.template.settings:
  index.number_of_shards: 3

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

# 输出到指定ES的配置
output.elasticsearch:
  hosts: ["127.0.0.1:9200"]
  username: "elastic"
  password: "123456"

6、运行filebeat：

"publish"