携手创作，共同成长！这是我参与「掘金日新计划 · 8 月更文挑战」的第22天，点击查看活动详情

filebeat收集错误日志并与普通日志并存

只收集正常日志往往是不完整的，错误日志更需要收集起来

1.配置filebeat收集error日志

所有集群都按如下配置，其实就是增加了一个type和一个index

vim /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/nginx/www_access.log
  json.keys_under_root: true
  json.overwrite_keys: true
  tags: ["www"]

- type: log
  enabled: true
  paths:
    - /var/log/nginx/bbs_access.log
  json.keys_under_root: true
  json.overwrite_keys: true
  tags: ["bbs"]

- type: log
  enabled: true
  paths:
    - /var/log/nginx/blog_access.log
  json.keys_under_root: true
  json.overwrite_keys: true
  tags: ["blog"]

- type: log
  enabled: true
  paths:
    - /var/log/nginx/error.log
  tags: ["error"]

output.elasticsearch:
  hosts: ["192.168.81.210:9200"]
  indices:
    - index: "nginx-www-access-%{+yyyy.MM.dd}"
      when.contains:
        tags: "www"

    - index: "nginx-bbs-access-%{+yyyy.MM.dd}"
      when.contains:
        tags: "bbs"

    - index: "nginx-blog-access-%{+yyyy.MM.dd}"
      when.contains:
        tags: "blog"

    - index: "nginx-error-%{+yyyy.MM.dd}"
      when.contains:
        tags: "error"

systemctl restart filebeat