Filebeat修改进程日志后仍输出到rsyslog

环境信息：

OS：CentOS Linux release 7.9.2009 (Core)

filebeat 版本：7.2.0

安装方式：rpm -ivh filebeat-7.2.0-x86_64.rpm

问题：

进程日志存放路径相关配置修改后，仍然输出到rsyslog（/var/log/message）里

解决:

filebeat.yml文件 进程日志相关配置

logging.level: info # 日志级别

logging.to_files: true

logging.files:

path: /var/log/filebeat

name: filebeat

keepfiles: 7

permissions: 0644

修改systemd启动脚本

[root@localhost]# vi /usr/lib/systemd/system/filebeat.service

ExecStart字段删除掉 $BEAT_LOG_OPTS变量，修改后的文件如下

------------------------

[Unit]

Description=Filebeat sends log files to Logstash or directly to Elasticsearch.

Documentation=https://www.elastic.co/products/beats/filebeat

Wants=network-online.target

After=network-online.target

[Service]

Environment="BEAT_LOG_OPTS=-e"

Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat/filebeat.yml"

Environment="BEAT_PATH_OPTS=-path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat"

ExecStart=/usr/share/filebeat/bin/filebeat $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS

Restart=always

[Install]

WantedBy=multi-user.target

-------------------------------

重新加载system

[root@localhost]#systemctl daemon-reload

重启服务

[root@localhost]#systemctl restart filebea