本机用docker搭建elk环境并接入frostmourne，实现监控报警效果
虽然logstash 和filebeat都具有日志收集功能，但是filebeat更轻量，占用资源更少，而不同的是logstash 具有filter功能，能过滤分析日志，所以一般都是filebeat采集日志，然后发送到MQ中，然后logstash去读取，利用filter功能过滤分析，然后存储到elasticsearch中
curl http://localhost:9200/_cat/indices\?v
docker run -d --name=filebeat docker.elastic.co/beats/filebeat:7.17.3 docker cp filebeat:/usr/share/filebeat /data/ #默认使用id 1000运行 chown -R 1000:1000 /data/filebeat/*docker
docker run -d \ --name=filebeat \ --restart=always \ -v /data/elk/filebeat:/usr/share/filebeat \ -v /data/logs:/data/logs \ docker.elastic.co/beats/filebeat:7.17.3#logs
echo {"T1":"2023-07-25"} >> t1.log ; echo {"T2":"2023-07-25"} >> t2.log
#filebeat.yaml
setup.kibana: host: "192.168.10.14:5601" output.elasticsearch.allow_older_versions: true filebeat.inputs: - input_type: log paths: - /data/logs/t1.log json.keys_under_root: true json.overwrite_keys: true fields: index: 't1_history' - input_type: log paths: - /data/logs/t2.log json.keys_under_root: true json.overwrite_keys: true fields: index: 't2_history' output.elasticsearch: hosts: ["192.168.10.14:9200"] indices: - index: "t1_history" when.contains: fields: index: "11_history" - index: "t2_history" when.contains: fields: index: "t2_history"
