本文介绍Filebeat7.4.0如何部署

写在前面

施工中

采集mysql 的slow与error日志

mysql配置 /etc/my.cnf #开启错误日志落盘 log-error=/data/mysql/logs/error.log #开启慢日志 slow_query_log=ON slow_query_log_file=/data/mysql/logs/slow.log long_query_time=1

#安装filebeat curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.4.0-x86_64.rpm sudo rpm -vi filebeat-7.4.0-x86_64.rpm

#开启采集mysql日志 filebeat modules enable mysql

#配置filebeat #编辑mysql模组文件 /etc/filebeat/modules.d/mysql.yaml

• module: mysql

  Error logs

  error: enabled: true

  Set custom paths for the log files. If left empty,

  Filebeat will choose the paths depending on your OS.

  #var.paths: var.paths: ["/data/mysql/logs/error.log"]

  Slow logs

  slowlog: enabled: true

  Set custom paths for the log files. If left empty,

  Filebeat will choose the paths depending on your OS.

  #var.paths: var.paths: ["/data/mysql/logs/slow.log"]

#编辑filebeat配置文件 #============================== Kibana ===================================== setup.kibana: host: “192.1.31.84:5601”

#————————– Elasticsearch output —————————— output.elasticsearch: hosts: [“192.1.31.82:9200”,“192.1.31.83:9200”] indices: - index: “mysql.error-%{+yyyy.MM.dd}” when.contains: fileset.name: “error” - index: “mysql.slowlog-%{+yyyy.MM.dd}” when.contains: fileset.name: “slowlog”

#启动filebeat && 加入开机启动

systemctl enable –now filebeat