ELK-Filebeat

Amos Xia, 2018-04-30 13:28:12

Filebeat is a log data shipper. Installed as an agent on your servers, Filebeat monitors the log directories or specific log files, tails the files, and forwards them either to Elasticsearch or Logstash for indexing.

Filebeat

Directory Layout

Type Description Default Location Config Option
home Home of the Filebeat installation. NULL path.home
bin The location for the binary files. {path.home} NULL
conf The location for configuration files. {path.home} path.conf
data he location for persistent data files. {path.home}/data path.data
logs The location for the logs created by Filebeat. {path.home}/logs path.logs

prospectors && harvesters

  • harvester, it’s responsible for reading the content of a single file. The harvester reads each file, line by line, and sends the content to the output. One harvester is started for one file.
  • prospector, it’s responsible for managing the harvesters and finding all sources to read from.

If a file is removed or renamed while it’s being harvested, Filebeat continues to read the file. The file space on disk is reserved until the harvester closes.


知识共享许可协议
本作品采用知识共享署名 4.0 国际许可协议进行许可。


Copyright© 2018 s2u2m