### **1\. 从官网下载rpm** ``` wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.15.2-x86_64.rpm ``` ### **2. 安装** ``` rpm -ivh filebeat-7.15.2-x86_64.rpm ``` ### **3. 修改配置文件** 配置文件位置：`/etc/filebeat`，Filebeat主要配置文件：`filebeat.yml` #### 3.1 修改input ~~~ filebeat.inputs: - type: log enabled: true paths: - D:\workspaces\projects\central-platform\logs\application\*\*.log exclude_lines: ['\sDEBUG\s\d'] exclude_files: ['sc-admin.*.log$'] fields: docType: sys-log project: microservices-platform multiline: pattern: '^\[\S+:\S+:\d{2,}] ' negate: true match: after - type: log enabled: true paths: - D:\workspaces\projects\central-platform\logs\point\*.log fields: docType: point-log project: microservices-platform ~~~ #### 3.2 修改output ~~~ hosts: ["192.168.28.130:5044"] bulk_max_size: 2048 ~~~ ### 3\. 启动Filebeat 默认读取`/etc/filebeat/filebeat.yml` ~~~ systemctl start filebeat ~~~