官网下载好包后直接配置 filebeat.yml



wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.3.0-linux-x86_64.tar.gz  tar xvf filebeat-6.3.0-linux-x86_64.tar.gz   mv filebeat-6.3.0-linux-x86_64 /usr/local/filebeat cd /usr/local/filebeat vim  filebeat.yml - type: log     # Change to true to enable this input configuration.   enabled: true     # Paths that should be crawled and fetched. Glob based paths.   paths:     - /data/logs/json/*.log     #- c:\programdata\elasticsearch\logs\*   json.keys_under_root: true   json.overwrite_keys: true output.kafka:   enabled: true   hosts: ["172.16.0.121:9092"]   topic: cms-web-access



我这是写到kafka的 用别名方式 需要绑定hosts cms-web-access到kafka主机

配置好后就可以启动了



nohup /usr/local/filebeat/filebeat -e -c /usr/local/filebeat/filebeat.yml >/dev/null 2>&1 &