安装好filebeat

1
站内搜索: 记录日志系统的安装-部署-配置-使用文档(1)

复制两个子文件夹下来

1
2
cp -r /etc/filebeat{,1}
cp -r /etc/filebeat{,2}

修改各自的filebeat.yml

1
2
3
4
...(省略inputs之类的)
logging.files:
  # 这里修改文件夹路径
  path: /var/log/filebeat1/2

这里主要是查看下机器systemd的path

我这里是/usr/lib/systemd/system

添加两份配置文件

  • vi /usr/lib/systemd/system/filebeat1.service

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    [Unit]
    Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
    Documentation=https://www.elastic.co/beats/filebeat
    Wants=network-online.target
    After=network-online.target

    [Service]

    Environment="GODEBUG='madvdontneed=1'"
    Environment="BEAT_LOG_OPTS="
    Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat1/filebeat.yml"
    Environment="BEAT_PATH_OPTS=--path.home /usr/share/filebeat --path.config /etc/filebeat1 --path.data /var/lib/filebeat1 --path.logs /var/log/filebeat1"
    ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
    Restart=always

    [Install]
    WantedBy=multi-user.target

  • vi /usr/lib/systemd/system/filebeat2.service

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    [Unit]
    Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
    Documentation=https://www.elastic.co/beats/filebeat
    Wants=network-online.target
    After=network-online.target

    [Service]

    Environment="GODEBUG='madvdontneed=1'"
    Environment="BEAT_LOG_OPTS="
    Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat2/filebeat.yml"
    Environment="BEAT_PATH_OPTS=--path.home /usr/share/filebeat --path.config /etc/filebeat2 --path.data /var/lib/filebeat2 --path.logs /var/log/filebeat2"
    ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
    Restart=always

    [Install]
    WantedBy=multi-user.target

然后启动看一下

1
2
3
4
5
6
7
8
systemctl start filebeat1.service
systemctl start filebeat2.service

systemctl status filebeat2.service
systemctl status filebeat1.service

less /var/log/filebeat1/filebeat
less /var/log/filebeat2/filebeat