架構說明
- 一台 ELK
- 三台 worker
- filebeat-6.3.0 for mac 版本加開機自動程式 plist
- 注意 要改 com.mlytics.filebeat.plist and filebeat.yml 使用者權限
chown root com.mlytics.filebeat.plist filebeat.yml
統一 filebeat 程式路徑說明:
/Users/prod-adp-1/scripts/filebeat-6.3.0-darwin-x86_64
/Users/prod-adp-2/scripts/filebeat-6.3.0-darwin-x86_64
/Users/prod-adp-3/scripts/filebeat-6.3.0-darwin-x86_64
統一 filebeat log 路徑說明
/Users/prod-adp-1/scripts/filebeat-6.3.0-darwin-x86_64/logs
/Users/prod-adp-2/scripts/filebeat-6.3.0-darwin-x86_64/logs
/Users/prod-adp-3/scripts/filebeat-6.3.0-darwin-x86_64/logs
開機自動程式 plist
/Library/LaunchDaemons/com.mlytics.filebeat.plist 名稱自取-注意使用者不一樣
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/Property\
List-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.mlytics.filebeat</string>
<key>StandardOutPath</key>
<string>/Users/prod-adp-3/scripts/filebeat-6.3.0-darwin-x86_64/logs/filebeat-output.txt</string>
<key>StandardErrorPath</key>
<string>/Users/prod-adp-3/scripts/filebeat-6.3.0-darwin-x86_64/logs/filebeat-errors.txt</string>
<key>ProgramArguments</key>
<array>
<string>/Users/prod-adp-3/scripts/filebeat-6.3.0-darwin-x86_64/filebeat</string>
<string>-e</string>
<string>-c</string>
<string>/Users/prod-adp-3/scripts/filebeat-6.3.0-darwin-x86_64/filebeat.yml</string>
</array>
<key>KeepAlive</key>
<true/>
</dict>
</plist>
/Users/prod-adp-3/scripts/filebeat-6.3.0-darwin-x86_64/filebeat.yml 名稱自取-注意使用者不一樣
filebeat.prospectors:
- input_type: log
enabled: true
paths:
- /tmp/core-distribute.log
- /Users/prod-adp-3/adp-core-codesign/.adp/.journal/tmp.log
output.elasticsearch:
hosts: ["35.221.170.173:9200"]
index: "adp-worker-3-%{+yyyy.MM.dd}"
setup.template.name: "adp-worker-3"
setup.template.pattern: "adp-worker-3-*"
setup.template.overwrite: false
setup.template.settings:
# _source.enabled: false
index.number_of_shards: 1
index.number_of_replicas: 0
設定方式 – plist 複製前要看設定內容對不對
# sudo cp /Users/prod-adp-3/scripts/filebeat-6.3.0-darwin-x86_64/com.mlytics.filebeat.plist /Library/LaunchDaemons/com.mlytics.filebeat.plist
# sudo launchctl load -w /Library/LaunchDaemons/com.mlytics.filebeat.plist 啟用
停用方式
sudo launchctl load -w /Library/LaunchDaemons/com.mlytics.filebeat.plist
查看服務1
sudo launchctl list | grep com.mlytics.filebeat
20521 0 com.mlytics.filebeat
查看服務 2
ps aux | grep filebeat
root 20521 0.0 0.2 558485108 16800 ?? Ss 10:56上午 0:00.13 /Users/prod-adp-1/scripts/filebeat-6.3.0-darwin-x86_64/filebeat -e -c /Users/prod-adp-1/scripts/filebeat-6.3.0-darwin-x86_64/filebeat.yml