1 基础知识

1.1 软件的介绍

– Filebeat是一个用于转发和集中日志数据的轻量级传送器
– Filebeat作为代理安装到服务器，监视指定的日志文件或位置，收集日志事件
– Filebeat将收集的日志转发到Elasticsearch或Logstash进行索引

1.2 工作原理

如上图所示，
– Filebeat主要包含两组件，输入（inputs）和收割机（harvesters）
– Filebeat的收割机负责逐行读取单个文件的内容（即每个文件一个收割机），并将内容发给输出
– Filebeat的输入负责管理收割机并查找模式匹配源且为每个匹配到的文件单独启动收割机
– Filebeat的收割机（Harvester）会获取日志的最新内容并将日志发送到Filebeat的libbeat（libeat是一种轻量数据采集器框架）
– Filebeat的轻量数据采集器会聚合并将聚合事件并发送到Filebeat配置的输出（Elasticsearch、Logstash等）
注意：收割机运行文件描述符保持打开状态，如文件收集过程中被删除或重命名，Filebeat会继续读取该文件

2 最佳实践

2.1 环境信息

Host Name = filebeat.cmdschool.org
OS = Oracle Linux 9.x x86_64
IP Address = any

2.2 安装前的准备

In Filebeat,

2.2.1 基本环境配置

如何完成CentOS 7.x的基本服务？

2.2.2 配置安装源

vim /etc/yum.repos.d/elasticsearc.repo

加入如下配置，

[elasticsearch]
name=Elasticsearch repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

2.3 安装Filebeat

2.3.1 安装指定的版本

dnf install -y filebeat-8.11.3

2.3.2 启动服务并设置自启动

systemctl start filebeat.service
systemctl enable filebeat.service

另外，建议你使用如下命令检查服务状态，

systemctl status filebeat.service

可见如下提示，

● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
     Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; preset: disabled)
     Active: active (running) since Wed 2024-01-03 15:16:37 CST; 1 week 0 days ago
       Docs: https://www.elastic.co/beats/filebeat
   Main PID: 11102 (filebeat)
      Tasks: 6 (limit: 11121)
     Memory: 47.5M
        CPU: 1min 51.399s
     CGroup: /system.slice/filebeat.service
             └─11102 /usr/share/filebeat/bin/filebeat --environment systemd -c /etc/filebeat/filebeat.yml --path.home /usr/share/filebeat --path.config /e>

Jan 11 09:33:07 filebeat.cmdschool.org filebeat[11102]: {"log.level":"info","@timestamp":"2024-01-11T09:33:07.609+0800","log.logger":"monitoring",">
Jan 11 09:33:37 filebeat.cmdschool.org filebeat[11102]: {"log.level":"info","@timestamp":"2024-01-11T09:33:37.609+0800","log.logger":"monitoring",">
Jan 11 09:34:07 filebeat.cmdschool.org filebeat[11102]: {"log.level":"info","@timestamp":"2024-01-11T09:34:07.616+0800","log.logger":"monitoring",">
Jan 11 09:34:37 filebeat.cmdschool.org filebeat[11102]: {"log.level":"info","@timestamp":"2024-01-11T09:34:37.609+0800","log.logger":"monitoring",">
Jan 11 09:35:07 filebeat.cmdschool.org filebeat[11102]: {"log.level":"info","@timestamp":"2024-01-11T09:35:07.609+0800","log.logger":"monitoring",">
Jan 11 09:35:37 filebeat.cmdschool.org filebeat[11102]: {"log.level":"info","@timestamp":"2024-01-11T09:35:37.609+0800","log.logger":"monitoring",">
Jan 11 09:36:07 filebeat.cmdschool.org filebeat[11102]: {"log.level":"info","@timestamp":"2024-01-11T09:36:07.609+0800","log.logger":"monitoring",">
Jan 11 09:36:37 filebeat.cmdschool.org filebeat[11102]: {"log.level":"info","@timestamp":"2024-01-11T09:36:37.609+0800","log.logger":"monitoring",">
Jan 11 09:37:07 filebeat.cmdschool.org filebeat[11102]: {"log.level":"info","@timestamp":"2024-01-11T09:37:07.609+0800","log.logger":"monitoring",">
Jan 11 09:37:37 filebeat.cmdschool.org filebeat[11102]: {"log.level":"info","@timestamp":"2024-01-11T09:37:37.610+0800","log.logger":"monitoring",">

如果需要查询运行的进程号，可使用如下命令，

pgrep -u root filebeat -a

可见如下显示，

11102 /usr/share/filebeat/bin/filebeat --environment systemd -c /etc/filebeat/filebeat.yml --path.home /usr/share/filebeat --path.config /etc/filebeat --path.data /var/lib/filebeat --path.logs /var/log/filebeat

然后，服务倾听的端口可使用如下命令，

for i in `pgrep -u root filebeat`; do netstat -anp | grep $i; done

可见如下显示，

unix  3      [ ]         STREAM     CONNECTED     1031670  11102/filebeat       
unix  2      [ ]         DGRAM      CONNECTED     1031680  11102/filebeat 

参阅文档
================

软件的介绍
——————
https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html

Filebeat工作原理
——————
https://www.elastic.co/guide/en/beats/filebeat/current/how-filebeat-works.html

Filebeat安装
—————–
https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html