Filebeat와 Elastic Search 연동

OS : CentOS

 

1. Filebeat 인스톨

# vi /etc/yum.repos.d/Elastic.repo
---------------------------------------------
[elastic-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

# yum -y install filebeat

 

2. Filebeat 환경설정

# vi /etc/filebeat/filebeat.yml
------------------------------------------
##input 설정

filebeat.inputs:
- type: log
  enabled: true #true로 수정
  paths:
    - /var/log/gitlab/nginx/gitlab_access.log

##output 설정

output.elasticsearch:
  hosts: ["192.168.122.16:9200","192.168.122.17:9200"]
  #protocol: "https"
  #api_key: "id:api_key"
  #username: "elastic"
  #password: "changeme"

 

3. Filebeat 서비스 시작

# systemctl enable filebeat
# systemctl start filebeat

 

4. 정상 수집 확인

# curl 192.168.122.16:9200/_cat/indices?v