filebeat 7.5.2

Question

filebeat 用的是rpm包安装的，但是filebeat的日志文件老是往/var/log/messages里面打，不往/var/log/filebeat/下面打

但是在/var/log/messages 下面又读到了 配置文件时定义到/var/log/filebeat下面的 但是这个目录下面都是空的

请问老师 怎么改 让filebeat 组件自身的日志输出到/var/log/filebeat下面谢谢

Answer 1

rockybean 2020-02-18 17:47:30

参见这里

https://github.com/elastic/beats/issues/11855

从 7 版本开始默认都往 stderr 输出了，你可以改下 systemd 的配置

mkdir -p /etc/systemd/system/filebeat.service.d
cat > /etc/systemd/system/filebeat.service.d/disable_stderr_logging.conf <<'EOT'
[Service]
Environment="BEAT_LOG_OPTS="
EOT
systemctl daemon-reload
systemctl restart filebeat

• 提问者 苦瓜苦也 #1

  非常感谢！

Answer 2

rockybean 2020-02-18 14:15:49

https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html

可以自行设定

logging.level: info
logging.to_files: true
logging.files: 
    path: /var/log/filebeat  
    name: filebeat  
    keepfiles: 7  
    permissions: 0644

• 提问者 苦瓜苦也 #1

  filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /var/log/sys_total.log
    exclude_lines: ['qemu-ga']
  
  output.elasticsearch:
    hosts: ["http://192.168.167.234:9200","http://192.168.167.175:9200","http://192.168.167.204:9200"]
    index: "system-%{+YYYY.MM.dd}"
  
  logging.level: info
  logging.to_files: true
  logging.files:
      path: /var/log/filebeat
      name: filebeat
      keepfiles: 7
      permissions: 0644
  
  setup.ilm.enabled: false
  setup.template.name: system
  setup.template.pattern: system-*

• 提问者 苦瓜苦也 #2

  这样写还是不行