本机用docker搭建elk环境并接入frostmourne实现监控报警效果虽然logstash 和filebeat都具有日志收集功能但是filebeat更轻量占用资源更少而不同的是logstash 具有filter功能能过滤分析日志所以一般都是filebeat采集日志然后发送到MQ中然后logstash去读取利用filter功能过滤分析然后存储到elasticsearch中curl http://localhost:9200/_cat/indices\?vdocker run -d --namefilebeat docker.elastic.co/beats/filebeat:7.17.3 docker cp filebeat:/usr/share/filebeat /data/ #默认使用id 1000运行 chown -R 1000:1000 /data/filebeat/*dockerdocker run -d \ --namefilebeat \ --restartalways \ -v /data/elk/filebeat:/usr/share/filebeat \ -v /data/logs:/data/logs \ docker.elastic.co/beats/filebeat:7.17.3#logsecho {T1:2023-07-25} t1.log ; echo {T2:2023-07-25} t2.log#filebeat.yamlsetup.kibana: host: 192.168.10.14:5601 output.elasticsearch.allow_older_versions: true filebeat.inputs: - input_type: log paths: - /data/logs/t1.log json.keys_under_root: true json.overwrite_keys: true fields: index: t1_history - input_type: log paths: - /data/logs/t2.log json.keys_under_root: true json.overwrite_keys: true fields: index: t2_history output.elasticsearch: hosts: [192.168.10.14:9200] indices: - index: t1_history when.contains: fields: index: 11_history - index: t2_history when.contains: fields: index: t2_history
