1.修改Filebeat配置文件
cat >/etc/filebeat/filebeat.yml<<EOF filebeat.inputs: - type: log enabled: true paths: - /var/log/Elasticsearch/elasticsearch.log multiline.pattern: '^\[' multiline.negate: true multiline.match: after output.elasticsearch: hosts: ["10.0.0.51:9200"] index: "es-%{[beat.version]}-%{+yyyy.MM}" setup.template.name: "es" setup.template.pattern: "es-*" setup.template.enabled: false setup.template.overwrite: true EOF
systemctl restart filebeat
2.模拟报错
3.es-head插件已经能收到新数据
4.在kibana删除原来的索引,重新添加
5.查看效果
赞赏微信赞赏
支付宝赞赏