FileBeat + Logstash + Elasticsearch + Grafana 日志监控

1. filebeat 配置

====================Filebeat inputs==================
- type: log

  paths:
    - /data/log/project_name/*.log
  tags: ["project_name"]

- type: log
  paths:
    - /data/log/project_name/*.log
  tags: ["project_name"]

2. logstash 配置

input {
  beats {
    port => 6068
  }
}
filter {

  if "project_name" in [tags] {
    #不符合条件的删除 每条日志中必须要具有log_json
    if ([message] =~  "^(?!.*?log_json).*$") {
        drop {}
    }

    json {
        source => "message"
        remove_field => ["message"]
    }
  }
}

output { # 按日志tags的不同存入es中不同的index中
  if "project_name" in [tags] {
    elasticsearch {
      hosts => ["127.0.0.1:9200"]
      # 索引名字
      index => "project_name.log"
    }
  }

  stdout {}
}

 4. Grafana 安装：

wget https://dl.grafana.com/oss/release/grafana-6.7.1-1.x86_64.rpm
sudo yum install grafana-6.7.1-1.x86_64.rpm

centos6 启动命令

启动：service grafana-server start
停止：service grafana-server stop
重启：service grafana-server restart
加入开机自启动： chkconfig --add grafana-server on

centos7 启动命令

systemctl start grafana-server