在filebeat配置
filebeat.prospectors:
– input_type: log

# Paths that should be crawled and fetched. Glob based paths.
paths:
– /var/lib/mysql/localhost-slow.log
document_type: redhat.mysql.log
– input_type: log
paths:
– /var/log/yum.log
document_type: redhat.yum.log

在logstash的配置
input {
beats{
port =>5044
}
}
output {
if [type] == “redhat.mysql.log”
{
elasticsearch {
hosts => “192.168.40.66:9200”
index => “testserver_mysql.log-%{+YYYY.MM.DD}”
}
}

if [type] ==  “redhat.yum.log”
{
elasticsearch {
hosts => “192.168.40.66:9200”
index => “testserver_yum.log-%{+YYYY.MM.DD}”
}
}

stdout { codec=> rubydebug }

}

转载请注明：SuperIT » filebeat, logstash配合