安装好 Filebeat

1
站内搜索：记录日志系统的安装-部署-配置-使用文档(1)

复制两个子文件夹

1
2
cp -r /etc/filebeat{,1}
cp -r /etc/filebeat{,2}

修改各自的 filebeat.yml

1
2
3
4
...(省略 inputs 之类的)
logging.files:
  # 这里修改文件夹路径
  path: /var/log/filebeat1/2

查看机器 systemd 的 path

我这里是 /usr/lib/systemd/system

添加两份配置文件

  • vi /usr/lib/systemd/system/filebeat1.service
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
[Unit]
Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
Documentation=https://www.elastic.co/beats/filebeat
Wants=network-online.target
After=network-online.target

[Service]

Environment="GODEBUG='madvdontneed=1'"
Environment="BEAT_LOG_OPTS="
Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat1/filebeat.yml"
Environment="BEAT_PATH_OPTS=--path.home /usr/share/filebeat --path.config /etc/filebeat1 --path.data /var/lib/filebeat1 --path.logs /var/log/filebeat1"
ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
Restart=always

[Install]
WantedBy=multi-user.target
  • vi /usr/lib/systemd/system/filebeat2.service
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
[Unit]
Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
Documentation=https://www.elastic.co/beats/filebeat
Wants=network-online.target
After=network-online.target

[Service]

Environment="GODEBUG='madvdontneed=1'"
Environment="BEAT_LOG_OPTS="
Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat2/filebeat.yml"
Environment="BEAT_PATH_OPTS=--path.home /usr/share/filebeat --path.config /etc/filebeat2 --path.data /var/lib/filebeat2 --path.logs /var/log/filebeat2"
ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
Restart=always

[Install]
WantedBy=multi-user.target

启动并查看状态

1
2
3
4
5
6
7
8
systemctl start filebeat1.service
systemctl start filebeat2.service

systemctl status filebeat2.service
systemctl status filebeat1.service

less /var/log/filebeat1/filebeat
less /var/log/filebeat2/filebeat