filebeat接入nginx和mysql获取日志

下载nginx

（1） 直接下载
yum install nginx -y

（2）查看状态启动
systemctl start nginx
systemctl status nginx

（3）配置文件检查
nginx -t

（4）端口检查
netstat -tulpn | grep :80

（5）如果端口有其他服务，需要修改nginx默认端口80,改成没被占用的端口
vim /etc/nginx/nginx.conf

server {
        listen       8800;
        listen       [::]:8800;

（6）修改完成后启动nginx
systemctl start nginx

（7）检查启动成功
curl 127.0.0.1

下载MySQL

mkdir -p /opt/mysql/data
mkdir -p /opt/mysql/config
vim /opt/mysql/config/my.cnf

[mysqld]
user=mysql
default-storage-engine=INNODB
character-set-server=utf8
secure_file_priv=/var/lib/mysql
server-id=1
[client]
default-character-set=utf8
[mysql]
default-character-set=utf8

编辑docker-compose.yml文件

version: '2'

services:
  mysql:
    image: mysql:8.0
    container_name: mysq
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: Tgqs@123
    volumes:
      - /opt/mysql/data:/var/lib/mysql
      - /opt/mysql/config/my.cnf:/etc/mysql/my.cnf
    ports:
      - "3306:3306"

volumes:
  master_data:

启动docker

docker-compose up -d docker exec -it mysql
mysq mysql -uroot -proot password

修改filebeat配置文件

filebeat.inputs:
- type: log
  paths:
    - /var/log/nginx/access.log
  tags: ["ngnix"]
  fields:
    name: "ngnix-access"
  fields_under_root: true

- type: log
  paths:
    - /var/lib/docker/containers/e9be064c5cc99527906248cad7c7cb60ef7f3f66de86f704d0fa8f88cfcd72ef/e9be064c5cc99527906248cad7c7cb60ef7f3f66de86f704d0fa8f88cfcd72ef-json.log
  tags: ["mysql"]
  fields:
    name: "mysql"
  fields_under_root: true

output.elasticsearch:
  hosts: ["http://172.16.208.12:9200","http://172.16.208.13:9200"]
  indices:
    - index: "Tgqs-nginx-%{+yyyy.MM.dd}"
      when.contains:
        tags: "ngnix"  
    - index: "Tgqs-mysql-%{+yyyy.MM.dd}"
      when.contains:
        tags: "mysql"

setup.template.enabled: false
setup.template.name: "Tgqs"
setup.template.pattern: "Tgqs-*"
setup.ilm.enabled: false

启动filebeat