Linux从入门到放弃 配置filebeat的模块功能

1、启用filebeat模块功能

vim /etc/filebeat/filebeat.yml
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true
  reload.period: 10s

2、开启MySQL模块

 filebeat modules enable mysql
 filebeat modules list

3、修改模块配置文件

 vim /etc/filebeat/modules.d/mysql.yml
 [root@web filebeat]# cat /etc/filebeat/modules.d/mysql.yml 
- module: mysql
  error:
    enabled: true
    var.paths: ["/var/log/mariadb/mariadb.log"]
   
  slowlog:
    enabled: true
    var.paths: ["/var/log/mariadb/slow.log"]

4、修改filebeat的主配置文件

vim /etc/filebeat/filebeat.yml
output.elasticsearch:
  hosts: ["10.0.0.10:9200","10.0.0.11:9200"]
  indices:
    - index: "mariadb-slow-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        source: "/var/log/mariadb/slow.log"
    - index: "mariadb-error-%{[beat.version]}-%{+yyyy.MM}"
      when.contains:
        source: "/var/log/mariadb/mariadb.log"
setup.template.name: "mariadb"
setup.template.pattern: "mariadb-*"
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true
  reload.period: 10s

5、重启filebeat服务

systemctl restart filebeat

6、在head界面检查日志是否收集成功

7、在kibana界面展示日志