Filebeat 설치 및 ElasticSearch 연동

1. Filebeat 다운로드 

$ vi /etc/yum.repos.d/Elastic.repo
-----------------------------------------------------------
[elastic-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
-----------------------------------------------------------

$ wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.9.1-linux-x86_64.tar.gz
$ tar -zxvf filebeat-7.9.1-linux-x86_64.tar.gz
$ mv filebeat-7.9.1-linux-x86_64 /usr/local/filebeat
$ chown -R root:root /usr/local/filebeat

2. 중지/기동 스크립트 등록

$ vi /lib/systemd/system/filebeat.service
-----------------------------------------------------------
[Unit]
Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
Documentation=https://www.elastic.co/products/beats/filebeat
Wants=network-online.target
After=network-online.target

[Service]
ExecStart=/usr/local/filebeat/filebeat -c /usr/local/filebeat/filebeat.yml -path.data /usr/local/filebeat/data
Restart=always

[Install]
WantedBy=multi-user.target
-----------------------------------------------------------

$ systemctl daemon-reload
$ systemctl enable filebeat

3. Filebeat 설정

$ vi /usr/local/filebeat/filebeat.yml 
-----------------------------------------------------------
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /data/logs/jeus8_5/msJpkim0*/JeusServer.log
...
output.elasticsearch:
  hosts: ["192.168.20.50:9200","192.168.20.51:9200","192.168.20.52:9200"]
  indices:
    - index: "was-jpkim1-%{+yyyy.MM.dd}"
  
setup.template.name: "was-jpkim"
setup.template.pattern: "was-jpkim*"
-----------------------------------------------------------

4. Filebeat 실행

$ systemctl start filebeat