安装好filebeat

1
站内搜索: 记录日志系统的安装-部署-配置-使用文档(1)

复制两个子文件夹下来

1
2
cp -r /etc/filebeat{,1}
cp -r /etc/filebeat{,2}

修改各自的filebeat.yml

1
2
3
4
...(省略inputs之类的)
logging.files:
  # 这里修改文件夹路径
  path: /var/log/filebeat1/2

这里主要是查看下机器systemd的path

我这里是/usr/lib/systemd/system

添加两份配置文件

  • vi /usr/lib/systemd/system/filebeat1.service
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
[Unit]
Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
Documentation=https://www.elastic.co/beats/filebeat
Wants=network-online.target
After=network-online.target

[Service]

Environment="GODEBUG='madvdontneed=1'"
Environment="BEAT_LOG_OPTS="
Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat1/filebeat.yml"
Environment="BEAT_PATH_OPTS=--path.home /usr/share/filebeat --path.config /etc/filebeat1 --path.data /var/lib/filebeat1 --path.logs /var/log/filebeat1"
ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
Restart=always

[Install]
WantedBy=multi-user.target
  • vi /usr/lib/systemd/system/filebeat2.service
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
[Unit]
Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
Documentation=https://www.elastic.co/beats/filebeat
Wants=network-online.target
After=network-online.target

[Service]

Environment="GODEBUG='madvdontneed=1'"
Environment="BEAT_LOG_OPTS="
Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat2/filebeat.yml"
Environment="BEAT_PATH_OPTS=--path.home /usr/share/filebeat --path.config /etc/filebeat2 --path.data /var/lib/filebeat2 --path.logs /var/log/filebeat2"
ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
Restart=always

[Install]
WantedBy=multi-user.target

然后启动看一下

1
2
3
4
5
6
7
8
systemctl start filebeat1.service
systemctl start filebeat2.service

systemctl status filebeat2.service
systemctl status filebeat1.service

less /var/log/filebeat1/filebeat
less /var/log/filebeat2/filebeat