下載
https://www.elastic.co/downloads/beats/
1、metricbeat
支持的服務列表
Apache麸祷、HAProxy赠群、MongoDB离咐、MySQL、Nginx帮匾、PostgreSQL啄骇、Redis、System瘟斜、Zookeeper
上傳并解壓縮metricbeat-5.4.0-linux-x86_64.tar.gz
tar -zxvf metricbeat-5.4.0-linux-x86_64.tar.gz
配置metricbeat缸夹，可以參考metricbeat.full.yml中的配置。
vim /usr/local/metricbeat-5.4.0-linux-x86_64/metricbeat.yml
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["192.168.1.101:9200","192.168.1.102:9200","192.168.1.103:9200"]
# Optional protocol and basic auth credentials.
#protocol: "https"
username: "elastic"
password: "123456"
name:"metricbeat-1-103"
tags: ["service-X", "web-tier"]
fields:
env: dev
檢查配置是否正確
cd /usr/local/metricbeat-5.4.0-linux-x86_64/
./metricbeat -c metricbeat.yml -configtest
創(chuàng)建mapping模板螺句，因為metricbeat第一次啟動時候虽惭，會把mapping自動建立在es上，所以不用手工創(chuàng)建了蛇尚。如果直接輸出到logstash芽唇，需要手工創(chuàng)建
curl -H 'Content-Type: application/json' -XPUT 'http://192.168.1.101:9200/_template/metricbeat' -d@/usr/local/metricbeat-5.4.0-linux-x86_64/metricbeat.template.json
啟動
sudo /usr/local/metricbeat-5.4.0-linux-x86_64/metricbeat start
報錯處理，必須文件所屬于root
metricbeat2017/05/31 02:21:09.305375 beat.go:339: CRIT Exiting: error loading config file: config file ("metricbeat.yml") must be owned by the beat user (uid=0) or root
Exiting: error loading config file: config file ("metricbeat.yml") must be owned by the beat user (uid=0) or root
chown -R root /usr/local/metricbeat-5.4.0-linux-x86_64
導入kibana dashboard
cd /usr/local/metricbeat-5.4.0-linux-x86_64/
在線安裝
./scripts/import_dashboards -es http://192.168.1.101:9200 -user elastic -pass 123456
離線安裝
./scripts/import_dashboards -file beats-dashboards-5.4.0.zip -es http://192.168.1.101:9200 -user elastic -pass 123456
2取劫、heartbeat
支持的協(xié)議
ICMP (v4 and v6) 匆笤、TCP研侣、HTTP
上傳并解壓縮heartbeat-5.4.0-linux-x86_64.tar.gz
tar -zxvf heartbeat-5.4.0-linux-x86_64.tar.gz
配置metricbeat，可以參考heartbeat.full.yml中的配置疚膊。
vim /usr/local/heartbeat-5.4.0-linux-x86_64/heartbeat.yml
###################### Heartbeat #######################
# Configure monitors
heartbeat.monitors:
- type: http
# List or urls to query
urls: ["http://192.168.1.101"]
# Configure task schedule
schedule: '@every 10s'
# 與java的 quartz cron表達式一致：秒 分 時 日 月 周 年
#schedule: '*/10 * * * * * *'
# Total test connection and data exchange timeout
#timeout: 16s
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["192.168.1.101:9200","192.168.1.102:9200","192.168.1.103:9200"]
# Optional protocol and basic auth credentials.
#protocol: "https"
username: "elastic"
password: "123456"
檢查配置是否正確
cd /usr/local/heartbeat-5.4.0-linux-x86_64/
./heartbeat -c heartbeat.yml -configtest
啟動
/usr/local/heartbeat-5.4.0-linux-x86_64/heartbeat start
導入kibana dashboard
cd /usr/local/heartbeat-5.4.0-linux-x86_64/
在線安裝
./scripts/import_dashboards -es http://192.168.1.101:9200 -user elastic -pass 123456
離線安裝
./scripts/import_dashboards -file beats-dashboards-5.4.0.zip -es http://192.168.1.101:9200 -user elastic -pass 123456
進入kibana查看：
http://192.168.1.102:5601/
其他配置模塊
heartbeat.monitors:
- type: icmp
schedule: '*/5 * * * * * *'
hosts: ["myhost"]
- type: tcp
schedule: '@every 5s'
hosts: ["myhost:7"] # default TCP Echo Protocol
check.send: "Check"
check.receive: "Check"
- type: http
schedule: '@every 5s'
urls: ["http://localhost:80/service/status"]
check.response.status: 200
heartbeat.scheduler:
limit: 10
3义辕、packetbeat
支持協(xié)議列表
ICMP (v4 and v6)、DNS寓盗、HTTP灌砖、AMQP 0.9.1、Cassandra傀蚌、Mysql基显、PostgreSQL、Redis善炫、Thrift-RPC撩幽、MongoDB、Memcache
上傳并解壓縮packetbeat-5.4.0-linux-x86_64.tar.gz
tar -zxvf packetbeat-5.4.0-linux-x86_64.tar.gz
配置packetbeat箩艺，可以參考packetbeat.full.yml中的配置窜醉。
vim /usr/local/packetbeat-5.4.0-linux-x86_64/packetbeat.yml
packetbeat.interfaces.device: any
packetbeat.protocols.http:
# Configure the ports where to listen for HTTP traffic. You can disable
# the HTTP protocol by commenting out the list of ports.
ports: [80, 8080, 8000, 5000, 8002, 9100l]
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["192.168.1.101:9200","192.168.1.102:9200","192.168.1.103:9200"]
# Optional protocol and basic auth credentials.
#protocol: "https"
username: "elastic"
password: "123456"
檢查配置是否正確
cd /usr/local/packetbeat-5.4.0-linux-x86_64/
chown -R root *
./packetbeat -c packetbeat.yml -configtest
啟動
sudo /usr/local/packetbeat-5.4.0-linux-x86_64/packetbeat start
導入kibana dashboard
cd /usr/local/packetbeat-5.4.0-linux-x86_64/
在線安裝
./scripts/import_dashboards -es http://192.168.1.101:9200 -user elastic -pass 123456
離線安裝
./scripts/import_dashboards -file beats-dashboards-5.4.0.zip -es http://192.168.1.101:9200 -user elastic -pass 123456
4、filebeat
上傳并解壓縮filebeat-5.4.0-linux-x86_64.tar.gz
tar -zxvf filebeat-5.4.0-linux-x86_64.tar.gz
配置filebeat艺谆，可以參考filebeat.full.yml中的配置榨惰。
vim /usr/local/filebeat-5.4.0-linux-x86_64/filebeat.yml
#=========================== Filebeat prospectors =============================
filebeat.prospectors:
# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.
- input_type: log
# Paths that should be crawled and fetched. Glob based paths.
paths:
#- /var/log/*.log
- /usr/local/heartbeat-5.4.0-linux-x86_64/logs/heartbeat
#- c:\programdata\elasticsearch\logs\*
# Exclude lines. A list of regular expressions to match. It drops the lines that are
# matching any regular expression from the list.
#exclude_lines: ["^DBG"]
# Include lines. A list of regular expressions to match. It exports the lines that are
# matching any regular expression from the list.
#include_lines: ["^ERR", "^WARN"]
# Exclude files. A list of regular expressions to match. Filebeat drops the files that
# are matching any regular expression from the list. By default, no files are dropped.
#exclude_files: [".gz$"]
# Optional additional fields. These field can be freely picked
# to add additional information to the crawled log files for filtering
#fields:
# level: debug
# review: 1
### Multiline options
# Mutiline can be used for log messages spanning multiple lines. This is common
# for Java Stack Traces or C-Line Continuation
# The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
#multiline.pattern: ^\[
# Defines if the pattern set under pattern should be negated or not. Default is false.
//如果下一行沒有匹配上，則屬于前一行
#multiline.negate: true
# Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
# that was (not) matched before or after or as long as a pattern is not matched based on negate.
# Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
#multiline.match: after
檢查配置是否正確
cd /usr/local/filebeat-5.4.0-linux-x86_64/filebeat -c filebeat.yml -configtest
啟動
/usr/local/filebeat-5.4.0-linux-x86_64/filebeat start
導入kibana dashboard
cd /usr/local/filebeat-5.4.0-linux-x86_64
在線安裝
./scripts/import_dashboards -es http://192.168.1.101:9200 -user elastic -pass 123456
離線安裝
./scripts/import_dashboards -file beats-dashboards-5.4.0.zip -es http://192.168.1.101:9200 -user elastic -pass 123456
