1.安装tomcat
2.配置tomcat日志格式为json
找到tomcat安装路径里的server.xml配置文件修改如下内容
vim /opt/tomcat/conf/server.xml pattern="{"clientip":"%h","ClientUser":"%l","authenticated":"%u","AccessTime":"%t","method":"%r","status":"%s","SendBytes":"%b","Query?string":"%q","partner":"%{Referer}i","AgentVersion":"%{User-Agent}i"}"/>
3.启动tomcat
/opt/tomcat/bin/startup.sh
4.配置Filebeat
cat >/etc/filebeat/filebeat.yml <<EOF filebeat.inputs: - type: log enabled: true paths: - /opt/tomcat/logs/localhost_access_log.*.txt json.keys_under_root: true json.overwrite_keys: true tags: ["tomcat"] output.Elasticsearch: hosts: ["10.0.0.51:9200"] index: "tomcat_access-%{[beat.version]}-%{+yyyy.MM}" setup.template.name: "tomcat" setup.template.pattern: "tomcat_*" setup.template.enabled: false setup.template.overwrite: true EOF
5.重启filebeat
systemctl restart filebeat
6.访问tomcat查看是否有数据生成
赞赏
微信赞赏
支付宝赞赏