神秘狐,梦想 构架一个世界
一键设置java 环境变量
@reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v ClassPath /t reg_expand_sz /d ".\;%%JAVA_HOME%%\%%Java_Home%%\lib\dt.%%Java_Home%%\lib\tools.jar" /f
@reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v path /t reg_expand_sz /d ".;%path%;%%Java_Home%%\bin" /f
@reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v Java_Home /t reg_sz /d "%cd%" /f
以上是我从XDA淘到的，然后根据实际修改的。
把此文件保存为【JAVA环境变量设置.bat】文件（名称可以自定义哦）,在JDK目录中执行，要用管理员权限哦
选择 Java Platform (JDK)
安装就不用写了吧！
我自己的安装目录是C:\Java\jdk1.7.0_03
把刚才保存的【JAVA环境变量设置.bat】文件放到这个目录里，如上图。
点击执行，出现如下图所示表示JAVA环境变量已设置成功
我们来输出，刚装JAVA JDK的版本号。
至此成功！然后你们该干嘛干嘛把！
1.Java SE Development Kit (JDK) not found Error:Failed to find java version for 'C:\windows\system32\java.exe':
解决方法：
扫码向博主提问
非学，无以致疑；非问，无以广识
擅长领域：
没有更多推荐了，
加入CSDN，享受更精准的内容推荐，与500万程序员共同成长！Filebeat的高级配置-Filebeat部分
在Filebeat安装完成准备使用前，最好先对Filebeat进行一些详细的配置再使用，下面来详细讲解一下相关内容。
Filebeat的配置文件是/etc/filebeat/filebeat.yml，遵循YAML语法。具体可以配置如下几个项目：
FilebeatOutputShipperLogging(可选)Run Options（可选）
这个Blog主要讲解Filebeat的配置部分，其他部分后续会有新的Blog介绍。
Filebeat的部分主要定义prospector的列表，定义监控哪里的日志文件，关于如何定义的详细信息可以参考filebeat.yml中的注释，下面主要介绍一些需要注意的地方。
paths：指定要监控的日志，目前按照Go语言的glob函数处理。没有对配置目录做递归处理，比如配置的如果是：
/var/log/* /*.log
则只会去/var/log目录的所有子目录中寻找以”.log”结尾的文件，而不会寻找/var/log目录下以”.log”结尾的文件。
encoding：指定被监控的文件的编码类型，使用plain和utf-8都是可以处理中文日志的。
input_type：指定文件的输入类型log(默认)或者stdin。
exclude_lines：在输入中排除符合正则表达式列表的那些行。
include_lines：包含输入中符合正则表达式列表的那些行（默认包含所有行），include_lines执行完毕之后会执行exclude_lines。
exclude_files：忽略掉符合正则表达式列表的文件（默认为每一个符合paths定义的文件都创建一个harvester）。
fields：向输出的每一条日志添加额外的信息，比如“level:debug”，方便后续对日志进行分组统计。默认情况下，会在输出信息的fields子目录下以指定的新增fields建立子目录，例如fields.level。
level: debug
则在Kibana看到的内容如下：
fields_under_root：如果该选项设置为true，则新增fields成为顶级目录，而不是将其放在fields目录下。自定义的field会覆盖filebeat默认的field。例如添加如下配置：
level: debug
fields_under_root: true
则在Kibana看到的内容如下：
ignore_older：可以指定Filebeat忽略指定时间段以外修改的日志内容，比如2h（两个小时）或者5m(5分钟)。
close_older：如果一个文件在某个时间段内没有发生过更新，则关闭监控的文件handle。默认1h,change只会在下一次scan才会被发现
force_close_files：Filebeat会在没有到达close_older之前一直保持文件的handle，如果在这个时间窗内删除文件会有问题，所以可以把force_close_files设置为true，只要filebeat检测到文件名字发生变化，就会关掉这个handle。
scan_frequency：Filebeat以多快的频率去prospector指定的目录下面检测文件更新（比如是否有新增文件），如果设置为0s，则Filebeat会尽可能快地感知更新（占用的CPU会变高）。默认是10s。
document_type：设定Elasticsearch输出时的document的type字段，也可以用来给日志进行分类。
harvester_buffer_size：每个harvester监控文件时，使用的buffer的大小。
max_bytes：日志文件中增加一行算一个日志事件，max_bytes限制在一次日志事件中最多上传的字节数，多出的字节会被丢弃。
multiline：适用于日志中每一条日志占据多行的情况，比如各种语言的报错信息调用栈。这个配置的下面包含如下配置：
&code class="hljs applescript has-numbering" style="display: padding: 0 color: box-sizing: border- font-family: "Source Code Pro",font-size: white-space: border-radius: 0 word-wrap: background:"&pattern：多行日志开始的那一行匹配的pattern
negate：是否需要对pattern条件转置使用，不翻转设为&span class="hljs-constant" style="box-sizing: border-"&true&/span&，反转设置为&span class="hljs-constant" style="box-sizing: border-"&false&/span&
match：匹配pattern后，与前面（&span class="hljs-keyword" style="color: rgb(0, 0, 136); box-sizing: border-"&before&/span&）还是后面（&span class="hljs-keyword" style="color: rgb(0, 0, 136); box-sizing: border-"&after&/span&）的内容合并为一条日志
max_lines：合并的最多行数（包含匹配pattern的那一行）
&span class="hljs-keyword" style="color: rgb(0, 0, 136); box-sizing: border-"&timeout&/span&：到了&span class="hljs-keyword" style="color: rgb(0, 0, 136); box-sizing: border-"&timeout&/span&之后，即使没有匹配一个新的pattern（发生一个新的事件），也把已经匹配的日志事件发送出去&/code&&ul class="pre-numbering" style="box-sizing: border- position: width: 50 top: 0 left: 0 margin: 0 padding: 6px 0px 40 border-right-width: 1 border-right-style: border-right-color: rgb(221, 221, 221); list-style: text-align: background-color: rgb(238, 238, 238);"&&li style="box-sizing: border- padding: 0px 5"&1&/li&&li style="box-sizing: border- padding: 0px 5"&2&/li&&li style="box-sizing: border- padding: 0px 5"&3&/li&&li style="box-sizing: border- padding: 0px 5"&4&/li&&li style="box-sizing: border- padding: 0px 5"&5&/li&&/ul&
tail_files：如果设置为true，Filebeat从文件尾开始监控文件新增内容，把新增的每一行文件作为一个事件依次发送，而不是从文件开始处重新发送所有内容。
backoff：Filebeat检测到某个文件到了EOF之后，每次等待多久再去检测文件是否有更新，默认为1s。
max_backoff：Filebeat检测到某个文件到了EOF之后，等待检测文件更新的最大时间，默认是10秒。
backoff_factor：定义到达max_backoff的速度，默认因子是2，到达max_backoff后，变成每次等待max_backoff那么长的时间才backoff一次，直到文件有更新才会重置为backoff。比如：
如果设置成1，意味着去使能了退避算法，每隔backoff那么长的时间退避一次。
spool_size:spooler的大小，spooler中的事件数量超过这个阈值的时候会清空发送出去（不论是否到达超时时间）。
idle_timeout:spooler的超时时间，如果到了超时时间，spooler也会清空发送出去（不论是否到达容量的阈值）。
registry_file:记录filebeat处理日志文件的位置的文件
config_dir:如果要在本配置文件中引入其他位置的配置文件，可以写在这里（需要写完整路径），但是只处理prospector的部分。
publish_async：是否采用异步发送模式（实验功能）。
没有更多推荐了，
加入CSDN，享受更精准的内容推荐，与500万程序员共同成长！filebeat配置详解
filebeat配置详解
围观3270次
编辑日期： 字体：
按自己理解整理的filebeat.full.yml配置详解，剔除了部分感觉自己暂时用不到的配置。
木有任何格式，乱七八糟，只是先记在这里。
#filebeat 5.2.2
#prospector(input)段配置
filebeat.prospectors: #每一个prospectors，起始于一个破折号"-"
- input_type: log #默认log，从日志文件读取每一行。stdin，从标准输入读取
paths: #日志文件路径列表，可用通配符，不递归
- /var/log/*.log
encoding: plain #编码，默认无，plain(不验证或者改变任何输入), latin1, utf-8, utf-16be-bom, utf-16be, utf-16le, big5, gb18030, gbk, hz-gb-2312, euc-kr, euc-jp, iso-2022-jp, shift-jis
include_lines: ['^ERR', '^WARN'] #匹配行，后接一个正则表达式列表，默认无，如果启用，则filebeat只输出匹配行，如果同时指定了多行匹配，仍会按照include_lines做过滤
exclude_lines: ["^DBG"] #排除行，后接一个正则表达式的列表，默认无
exclude_files: [".gz$"] #排除文件，后接一个正则表达式的列表，默认无
ignore_older: 0 #排除更改时间超过定义的文件，时间字符串可以用2h表示2小时，5m表示5分钟，默认0
document_type: log #该type会被添加到type字段，对于输出到ES来说，这个输入时的type字段会被存储，默认log
scan_frequency: 10s #prospector扫描新文件的时间间隔，默认10秒
max_bytes:
#单文件最大收集的字节数，单文件超过此字节数后的字节将被丢弃，默认10MB，需要增大，保持与日志输出配置的单文件最大值一致即可
multiline.pattern: ^\[ #多行匹配模式，后接正则表达式，默认无
multiline.negate: false #多行匹配模式后配置的模式是否取反，默认false
multiline.match: after #定义多行内容被添加到模式匹配行之后还是之前，默认无，可以被设置为after或者before
multiline.max_lines: 500 #单一多行匹配聚合的最大行数，超过定义行数后的行会被丢弃，默认500
multiline.timeout: 5s #多行匹配超时时间，超过超时时间后的当前多行匹配事件将停止并发送，然后开始一个新的多行匹配事件，默认5秒
tail_files: false #可以配置为true和false。配置为true时，filebeat将从新文件的最后位置开始读取，如果配合日志轮循使用，新文件的第一行将被跳过
close_renamed: false #当文件被重命名或被轮询时关闭重命名的文件处理。注意：潜在的数据丢失。请务必阅读并理解此选项的文档。默认false
close_removed: true #如果文件不存在，立即关闭文件处理。如果后面文件又出现了，会在scan_frequency之后继续从最后一个已知position处开始收集，默认true
enabled: true #每个prospectors的开关，默认true
#filebeat全局配置
filebeat.spool_size: 2048 #后台事件计数阈值，超过后强制发送，默认2048
filebeat.idle_timeout: 5s #后台刷新超时时间，超过定义时间后强制发送，不管spool_size是否达到，默认5秒
filebeat.registry_file: ${path.data}/registry #注册表文件，同logstash的sincedb，记录日志文件信息，如果使用相对路径，则意味着相对于日志数据的路径
filebeat.config_dir: #定义filebeat配置文件目录，必须指定一个不同于filebeat主配置文件所在的目录，目录中所有配置文件中的全局配置会被忽略
#通用配置段
name: #配置发送者名称，如果不配置则使用hostname
tags: ["service-X", "web-tier"] #标记tag，可用于分组
fields: #添加附件字段，可以使values，arrays，dictionaries或者任何嵌套数据
env: staging
queue_size: 1000 #处理管道中单个事件内的队列大小，默认1000
max_procs: #设置最大CPU数，默认为CPU核数
#processors配置段
#Outputs配置段
output.elasticsearch: #elasticsearch输出模块
enabled: true #启用模块
hosts: ["localhost:9200"] #ES地址
compression_level: 0 #gzip压缩级别，默认0，不压缩，压缩耗CPU
worker: 1 #每个ES的worker数？？？？？，默认1
index: "filebeat-%{+yyyy.MM.dd}" #可选配置，ES索引名称，默认filebeat-%{+yyyy.MM.dd}
pipeline: "" #可选配置，输出到ES接收节点的pipeline，默认无
path: "/elasticsearch" #可选的，HTTP路径，默认无
proxy_url: http://proxy:3128 #http代理服务器地址，默认无
max_retries: 3 #ES重试次数，默认3次，超过3次后，当前事件将被丢弃
bulk_max_size: 50 #对一个单独的ES批量API索引请求的最大事件数？？？？？默认50
timeout: 90 #到ES的http请求超时时间？？？？？默认90秒
output.logstash: #logstash输出模块
enabled: true #启用模块
hosts: ["localhost:5044"] #logstash地址
worker: 1 #每个logstash的worker数？？？？？，默认1
compression_level: 3 #压缩级别，默认3
loadbalance: true #负载均衡开关，在不同的logstash间负载
pipelining: 0 #在处理新的批量期间，异步发送至logstash的批量次数？？？？？
index: 'filebeat' #可选配置，索引名称，默认为filebeat
proxy_url: socks5://user:password@socks5-server:2233 #socks5代理服务器地址
proxy_use_local_resolver: false #使用代理时是否使用本地解析，默认false
output.kafka: #kafka输出模块
output.redis: #redis输出模块
enabled: true #启用模块
hosts: ["localhost:6379"] #redis地址，地址为一个列表，如果loadbalance开启，则负载到里表中的服务器，当一个redis服务器不可达，事件将被分发到可到达的redis服务器
port: 6379 #redis端口，如果hosts内未包含端口信息，默认6379
key: filebeat #事件发布到redis的list或channel，默认filebeat
password: #redis密码，默认无
db: 0 #redis的db值，默认0
datatype: list #发布事件使用的redis数据类型，如果为list，使用RPUSH命令（生产消费模式）。如果为channel，使用PUBLISH命令{发布订阅模式}。默认为list
worker: 1 #为每个redis服务器启动的工作进程数，会根据负载均衡配置递增
loadbalance: true #负载均衡，默认开启
timeout: 5s #redis连接超时时间，默认5s
max_retries: 3 #filebeat会忽略此设置，并一直重试到全部发送为止，其他beat设置为0即忽略，默认3次
bulk_max_size: 2048 ##对一个redis请求或管道批量的最大事件数，默认2048
proxy_url: #socks5代理地址，必须使用socks5://
proxy_use_local_resolver: false #使用代理时是否使用本地解析，默认false
#Paths配置段
path.home: #家目录，filebeat安装目录，为其他所有path配置的默认基本路径，默认为filebeat二进制文件的本地目录
path.config: ${path.home} #filebeat配置路径，主配置文件和es模板的默认基本路径，默认为filebeat家目录
path.data: ${path.home}/data #filebeat数据存储路径，默认在filebeat家目录下
path.logs: ${path.home}/logs #filebeat日志存储路径，默认在filebeat家目录下
#logging配置段
#有3个可配置的filebeat日志输出选项：syslog,file,stderr
#windows默认输出到file
logging.level: info #设定日志级别，可设置级别有critical, error, warning, info, debug
logging.selectors: [ ] #开启debug输出的选择组件，开启所有选择使用["*"],其他可用选择为"beat","publish","service"
logging.to_syslog: true #输出所有日志到syslog，默认为false
logging.metrics.enabled: true #定期记录filebeat内部性能指标，默认true
logging.metrics.period: 30s #记录内部性能指标的周期，默认30秒
logging.to_files: true #输出所有日志到file，默认true
logging.files: #日志输出的文件配置
path: /var/log/filebeat #配置日志输出路径，默认在家目录的logs目录
name: filebeat #日志文件名
rotateeverybytes:
#日志轮循大小，默认10MB
keepfiles: 7 #日志轮循文件保存数量，默认7
#harvester收割者
#负责读取每个文件的内容，收割者一行一行的读取每个文件并发送内容到output，收割者负责打开和关闭文件
#prospector勘探者
#负责管理收割者和查找所有读取源。目前勘探者支持两个勘探类型，log和stdin,每个勘探类型可以被定义多次。龙勘探者检查每个文件来看是否需要打开一个收割者或收割者是否在运行，诱惑是否忽略这个文件
#filebeat如何保持文件状态？
#filebeat保持每个文件的状态并频繁刷新状态到磁盘上的注册文件
#状态用于记忆收割者读取的最后一个偏移量并确保所有的日志行被发送
#如果一个es或logstash的输出不可达时，filebeat将持续追踪发送的最后一样并继续读取文件，尽快可以变为可用的输出
#当filebeat运行时，状态信息将被每个勘探者保存在内存中
#当filebeat被重启，会使用注册文件读取数据重建状态，并且让每个收割者从一直的最后位置开始
#每个勘探者为他发现的每个文件保持一个状态，因为文件可能被删除或移动，文件名和路径不足以确定一个文件
#registry记录内容如下
[root@jenkins data]# cat registry
[{"source":"/var/log/messages","offset":5912,"FileStateOS":{"inode":,"device":64768},"timestamp":"T18:17:54.:00","ttl":-1}]
[root@jenkins data]# stat /var/log/messages
File: ‘/var/log/messages’
Size: 5912 Blocks: 16 IO Block: 4096 regular file
Device: fd00h/64768d Inode:
Access: (0600/-rw-------) Uid: ( 0/ root) Gid: ( 0/ root)
Context: system_u:object_r:var_log_t:s0
18:17:49. +0800
18:15:22. +0800
18:15:22. +0800
#multiline.negate和match组合
negate match
false after 连续匹配的行将被添加到前一个不匹配的行
false before 连续匹配的行将被预合并到后一个不匹配的行
true after 连续不匹配的行将被添加到前一个匹配的行
true before 连续不匹配的行将被预合并到后一个匹配的行
#注意：filebeat.registry_file，由于此配置是filebeat的全局配置，所以如果需要分开存储registry_file则必须拆分filebeat配置文件和进程。
#而logstash的sincedb配置是input.file段配置，每个input可以单独指定sincedb
#注意：如果如果output.redis的datatype使用list，redis在没有阻塞的情况下是看不到该list的
本文固定链接:
转载请注明:
作者：明明
这个作者貌似有点懒，什么都没有留下。
您可能还会对这些文章感兴趣！　　filebeat.yml，是在filebeat安装目录。
[hadoop@HadoopMaster filebeat-1.3.1-x86_64]$ pwd
/home/hadoop/app/filebeat-1.3.1-x86_64
[hadoop@HadoopMaster filebeat-1.3.1-x86_64]$ ll
total 11116
-rwxr-xr-x. 1 hadoop hadoop
2016 filebeat
-rw-r--r--. 1 hadoop hadoop
814 Sep 15
2016 filebeat.template.json
-rw-r--r--. 1 hadoop hadoop
17212 Sep 15
2016 filebeat.yml
[hadoop@HadoopMaster filebeat-1.3.1-x86_64]$ pwd
/home/hadoop/app/filebeat-1.3.1-x86_64
[hadoop@HadoopMaster filebeat-1.3.1-x86_64]$ vim filebeat.yml
filebeat.yml（中文配置详解）
################### Filebeat Configuration Example #########################
############################# Filebeat ######################################
# List of prospectors to fetch data.
prospectors:
# Each - is a prospector. Below are the prospector specific configurations
# Paths that should be crawled and fetched. Glob based paths.
# To fetch all ".log" files from a specific level of subdirectories
# /var/log/*/*.log can be used.
# For each file found under this path, a harvester is started.
# Make sure not file is defined twice as this can lead to unexpected behaviour.
# 指定要监控的日志，可以指定具体得文件或者目录
- /var/log/*.log
（这是默认的）（自行可以修改）(比如我放在/home/hadoop/app.log里）
#- c:\programdata\elasticsearch\logs\*
# Configure the file encoding for reading files with international characters
# following the W3C recommendation for HTML5 (http://www.w3.org/TR/encoding).
# Some sample encodings:
plain, utf-8, utf-16be-bom, utf-16be, utf-16le, big5, gb18030, gbk,
hz-gb-2312, euc-kr, euc-jp, iso-2022-jp, shift-jis, ...
# 指定被监控的文件的编码类型，使用plain和utf-8都是可以处理中文日志的
#encoding: plain
# Type of the files. Based on this the way the file is read is decided.
# The different types cannot be mixed in one prospector
# Possible options are:
# * log: Reads every line of the log file (default)
# * stdin: Reads the standard in
# 指定文件的输入类型log(默认)或者stdin
input_type: log
# Exclude lines. A list of regular expressions to match. It drops the lines that are
# matching any regular expression from the list. The include_lines is called before
# 在输入中排除符合正则表达式列表的那些行。
# exclude_lines. By default, no lines are dropped.
# exclude_lines: ["^DBG"]
# Include lines. A list of regular expressions to match. It exports the lines that are
# matching any regular expression from the list. The include_lines is called before
# exclude_lines. By default, all the lines are exported.
# 包含输入中符合正则表达式列表的那些行（默认包含所有行），include_lines执行完毕之后会执行exclude_lines
# include_lines: ["^ERR", "^WARN"]
# Exclude files. A list of regular expressions to match. Filebeat drops the files that
# are matching any regular expression from the list. By default, no files are dropped.
# 忽略掉符合正则表达式列表的文件
# exclude_files: [".gz$"]
# Optional additional fields. These field can be freely picked
# to add additional information to the crawled log files for filtering
# 向输出的每一条日志添加额外的信息，比如&level:debug&，方便后续对日志进行分组统计。
# 默认情况下，会在输出信息的fields子目录下以指定的新增fields建立子目录，例如fields.level
# 这个得意思就是会在es中多添加一个字段，格式为 "filelds":{"level":"debug"}
level: debug
# Set to true to store the additional fields as top level fields instead
# of under the "fields" sub-dictionary. In case of name conflicts with the
# fields added by Filebeat itself, the custom fields overwrite the default
# 如果该选项设置为true，则新增fields成为顶级目录，而不是将其放在fields目录下。
# 自定义的field会覆盖filebeat默认的field
# 如果设置为true，则在es中新增的字段格式为："level":"debug"
#fields_under_root: false
# Ignore files which were modified more then the defined timespan in the past.
# In case all files on your system must be read you can set this value very large.
# Time strings like 2h (2 hours), 5m (5 minutes) can be used.
# 可以指定Filebeat忽略指定时间段以外修改的日志内容，比如2h（两个小时）或者5m(5分钟)。
#ignore_older: 0
# Close older closes the file handler for which were not modified
# for longer then close_older
# Time strings like 2h (2 hours), 5m (5 minutes) can be used.
# 如果一个文件在某个时间段内没有发生过更新，则关闭监控的文件handle。默认1h
#close_older: 1h
# Type to be published in the 'type' field. For Elasticsearch output,
# the type defines the document type these entries should be stored
# in. Default: log
# 设定Elasticsearch输出时的document的type字段 可以用来给日志进行分类。Default: log
#document_type: log
# Scan frequency in seconds.
# How often these files should be checked for changes. In case it is set
# to 0s, it is done as often as possible. Default: 10s
# Filebeat以多快的频率去prospector指定的目录下面检测文件更新（比如是否有新增文件）
# 如果设置为0s，则Filebeat会尽可能快地感知更新（占用的CPU会变高）。默认是10s
#scan_frequency: 10s
# Defines the buffer size every harvester uses when fetching the file
# 每个harvester监控文件时，使用的buffer的大小
#harvester_buffer_size: 16384
# Maximum number of bytes a single log event can have
# All bytes after max_bytes are discarded and not sent. The default is 10MB.
# This is especially useful for multiline log messages which can get large.
# 日志文件中增加一行算一个日志事件，max_bytes限制在一次日志事件中最多上传的字节数，多出的字节会被丢弃
#max_bytes:
# Mutiline can be used for log messages spanning multiple lines. This is common
# for Java Stack Traces or C-Line Continuation
# 适用于日志中每一条日志占据多行的情况，比如各种语言的报错信息调用栈
#multiline:
# The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
# 多行日志开始的那一行匹配的pattern
#pattern: ^\[
# Defines if the pattern set under pattern should be negated or not. Default is false.
# 是否需要对pattern条件转置使用，不翻转设为true，反转设置为false。
【建议设置为true】
#negate: false
# Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
# that was (not) matched before or after or as long as a pattern is not matched based on negate.
# Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
# 匹配pattern后，与前面（before）还是后面（after）的内容合并为一条日志
#match: after
# The maximum number of lines that are combined to one event.
# In case there are more the max_lines the additional lines are discarded.
# Default is 500
# 合并的最多行数（包含匹配pattern的那一行）
#max_lines: 500
# After the defined timeout, an multiline event is sent even if no new pattern was found to start a new event
# Default is 5s.
# 到了timeout之后，即使没有匹配一个新的pattern（发生一个新的事件），也把已经匹配的日志事件发送出去
#timeout: 5s
# Setting tail_files to true means filebeat starts readding new files at the end
# instead of the beginning. If this is used in combination with log rotation
# this can mean that the first entries of a new file are skipped.
# 如果设置为true，Filebeat从文件尾开始监控文件新增内容，把新增的每一行文件作为一个事件依次发送，
# 而不是从文件开始处重新发送所有内容
#tail_files: false
# Backoff values define how agressively filebeat crawls new files for updates
# The default values can be used in most cases. Backoff defines how long it is waited
# to check a file again after EOF is reached. Default is 1s which means the file
# is checked every second if new lines were added. This leads to a near real time crawling.
# Every time a new line appears, backoff is reset to the initial value.
# Filebeat检测到某个文件到了EOF（文件结尾）之后，每次等待多久再去检测文件是否有更新，默认为1s
#backoff: 1s
# Max backoff defines what the maximum backoff time is. After having backed off multiple times
# from checking the files, the waiting time will never exceed max_backoff idenependent of the
# backoff factor. Having it set to 10s means in the worst case a new line can be added to a log
# file after having backed off multiple times, it takes a maximum of 10s to read the new line
# Filebeat检测到某个文件到了EOF之后，等待检测文件更新的最大时间，默认是10秒
#max_backoff: 10s
# The backoff factor defines how fast the algorithm backs off. The bigger the backoff factor,
# the faster the max_backoff value is reached. If this value is set to 1, no backoff will happen.
# The backoff value will be multiplied each time with the backoff_factor until max_backoff is reached
# 定义到达max_backoff的速度，默认因子是2，到达max_backoff后，变成每次等待max_backoff那么长的时间才backoff一次，
# 直到文件有更新才会重置为backoff
# 根据现在的默认配置是这样的，每隔1s检测一下文件变化，如果连续检测两次之后文件还没有变化，下一次检测间隔时间变为10s
#backoff_factor: 2
# This option closes a file, as soon as the file name changes.
# This config option is recommended on windows only. Filebeat keeps the files it's reading open. This can cause
# issues when the file is removed, as the file will not be fully removed until also Filebeat closes
# the reading. Filebeat closes the file handler after ignore_older. During this time no new file with the
# same name can be created. Turning this feature on the other hand can lead to loss of data
# on rotate files. It can happen that after file rotation the beginning of the new
# file is skipped, as the reading starts at the end. We recommend to leave this option on false
# but lower the ignore_older value to release files faster.
# 这个选项关闭一个文件,当文件名称的变化。#该配置选项建议只在windows
#force_close_files: false
# Additional prospector
# Configuration to use stdin input
#input_type: stdin
# General filebeat configuration options
# Event count spool threshold - forces network flush if exceeded
# spooler的大小，spooler中的事件数量超过这个阈值的时候会清空发送出去（不论是否到达超时时间）
#spool_size: 2048
# Enable async publisher pipeline in filebeat (Experimental!)
# 是否采用异步发送模式（实验功能）
#publish_async: false
# Defines how often the spooler is flushed. After idle_timeout the spooler is
# Flush even though spool_size is not reached.
# spooler的超时时间，如果到了超时时间，spooler也会清空发送出去（不论是否到达容量的阈值）
#idle_timeout: 5s
# Name of the registry file. Per default it is put in the current working
# directory. In case the working directory is changed after when running
# filebeat again, indexing starts from the beginning again.
# 记录filebeat处理日志文件的位置的文件，默认是在启动的根目录下
#registry_file: .filebeat
# Full Path to directory with additional prospector configuration files. Each file must end with .yml
# These config files must have the full filebeat config part inside, but only
# the prospector part is processed. All global options like spool_size are ignored.
# The config_dir MUST point to a different directory then where the main filebeat config file is in.
# 如果要在本配置文件中引入其他位置的配置文件，可以写在这里（需要写完整路径），但是只处理prospector的部分
#config_dir:
###############################################################################
############################# Libbeat Config ##################################
# Base config file used by all other beats for using libbeat features
############################# Output ##########################################
# Configure what outputs to use when sending the data collected by the beat.
# Multiple outputs may be used.
### Elasticsearch as output
elasticsearch:　　　　　　　　　　　　（这是默认的，filebeat收集后放到es里）（自行可以修改，比如我有时候想filebeat收集后，然后到redis，再到es，就可以注销这行）
# Array of hosts to connect to.
# Scheme and port can be left out and will be set to the default (http and 9200)
# In case you specify and additional path, the scheme is required: http://localhost:9200/path
# IPv6 addresses should always be defined as: https://[2001:db8::1]:9200
hosts: ["localhost:9200"]
（这是默认的，filebeat收集后放到es里）（自行可以修改，比如我有时候想filebeat收集后，然后到redis，再到es，就可以注销这行）
# Optional protocol and basic auth credentials. #protocol: "https" #username: "admin" #password: "s3cr3t" # Number of workers per Elasticsearch host. #worker: 1 # Optional index name. The default is "filebeat" and generates # [filebeat-]YYYY.MM.DD keys. #index: "filebeat" # A template is used to set the mapping in Elasticsearch # By default template loading is disabled and no template is loaded. # These settings can be adjusted to load your own template or overwrite existing ones #template: # Template name. By default the template name is filebeat. #name: "filebeat" # Path to template file #path: "filebeat.template.json" # Overwrite existing template #overwrite: false # Optional HTTP Path #path: "/elasticsearch" # Proxy server url #proxy_url: http://proxy:3128 # The number of times a particular Elasticsearch index operation is attempted. If # the indexing operation doesn't succeed after this many retries, the events are # dropped. The default is 3. #max_retries: 3 # The maximum number of events to bulk in a single Elasticsearch bulk API index request. # The default is 50. #bulk_max_size: 50 # Configure http request timeout before failing an request to Elasticsearch. #timeout: 90 # The number of seconds to wait for new events between two bulk API index requests. # If `bulk_max_size` is reached before this interval expires, addition bulk index # requests are made. #flush_interval: 1 # Boolean that sets if the topology is kept in Elasticsearch. The default is # false. This option makes sense only for Packetbeat. #save_topology: false # The time to live in seconds for the topology information that is stored in # Elasticsearch. The default is 15 seconds. #topology_expire: 15 # tls configuration. By default is off. #tls: # List of root certificates for HTTPS server verifications #certificate_authorities: ["/etc/pki/root/ca.pem"] # Certificate for TLS client authentication #certificate: "/etc/pki/client/cert.pem" # Client Certificate Key #certificate_key: "/etc/pki/client/cert.key" # Controls whether the client verifies server certificates and host name. # If insecure is set to true, all server host names and certificates will be # accepted. In this mode TLS based connections are susceptible to # man-in-the-middle attacks. Use only for testing. #insecure: true # Configure cipher suites to be used for TLS connections #cipher_suites: [] # Configure curve types for ECDHE based cipher suites #curve_types: [] # Configure minimum TLS version allowed for connection to logstash #min_version: 1.0 # Configure maximum TLS version allowed for connection to logstash #max_version: 1.2 ### Logstash as output #logstash: # The Logstash hosts #hosts: ["localhost:5044"] # Number of workers per Logstash host. #worker: 1 # The maximum number of events to bulk into a single batch window. The # default is 2048. #bulk_max_size: 2048 # Set gzip compression level. #compression_level: 3 # Optional load balance the events between the Logstash hosts #loadbalance: true # Optional index name. The default index name depends on the each beat. # For Packetbeat, the default is set to packetbeat, for Topbeat # top topbeat and for Filebeat to filebeat. #index: filebeat # Optional TLS. By default is off. #tls: # List of root certificates for HTTPS server verifications #certificate_authorities: ["/etc/pki/root/ca.pem"] # Certificate for TLS client authentication #certificate: "/etc/pki/client/cert.pem" # Client Certificate Key #certificate_key: "/etc/pki/client/cert.key" # Controls whether the client verifies server certificates and host name. # If insecure is set to true, all server host names and certificates will be # accepted. In this mode TLS based connections are susceptible to # man-in-the-middle attacks. Use only for testing. #insecure: true # Configure cipher suites to be used for TLS connections #cipher_suites: [] # Configure curve types for ECDHE based cipher suites #curve_types: [] ### File as output #file: # Path to the directory where to save the generated files. The option is mandatory. #path: "/tmp/filebeat" # Name of the generated files. The default is `filebeat` and it generates files: `filebeat`, `filebeat.1`, `filebeat.2`, etc. #filename: filebeat # Maximum size in kilobytes of each file. When this size is reached, the files are # rotated. The default value is 10 MB. #rotate_every_kb: 10000 # Maximum number of files under path. When this number of files is reached, the # oldest file is deleted and the rest are shifted from last to first. The default # is 7 files. #number_of_files: 7 ### Console output # console: # Pretty print json event #pretty: false ############################# Shipper ######################################### shipper: # The name of the shipper that publishes the network data. It can be used to group # all the transactions sent by a single shipper in the web interface. # If this options is not defined, the hostname is used. #name: # The tags of the shipper are included in their own field with each # transaction published. Tags make it easy to group servers by different # logical properties. #tags: ["service-X", "web-tier"] # Uncomment the following if you want to ignore transactions created # by the server on which the shipper is installed. This option is useful # to remove duplicates if shippers are installed on multiple servers. #ignore_outgoing: true # How often (in seconds) shippers are publishing their IPs to the topology map. # The default is 10 seconds. #refresh_topology_freq: 10 # Expiration time (in seconds) of the IPs published by a shipper to the topology map. # All the IPs will be deleted afterwards. Note, that the value must be higher than # refresh_topology_freq. The default is 15 seconds. #topology_expire: 15 # Internal queue size for single events in processing pipeline #queue_size: 1000 # Configure local GeoIP database support. # If no paths are not configured geoip is disabled. #geoip: #paths: # - "/usr/share/GeoIP/GeoLiteCity.dat" # - "/usr/local/var/GeoIP/GeoLiteCity.dat" ############################# Logging ######################################### # There are three options for the log ouput: syslog, file, stderr. # Under Windos systems, the log files are per default sent to the file output, # under all other system per default to syslog. # 建议在开发时期开启日志并把日志调整为debug或者info级别，在生产环境下调整为error级别 # 开启日志 必须设置to_files 属性为true logging: # Send all logging output to syslog. On Windows default is false, otherwise # default is true. # 配置beats日志。日志可以写入到syslog也可以是轮滚日志文件。默认是syslog # tail -f /var/log/messages #to_syslog: true # Write all logging output to files. Beats automatically rotate files if rotateeverybytes # limit is reached. # 日志发送到轮滚文件 #to_files: false # To enable logging to files, to_files option has to be set to true # to_files设置为true才可以开启轮滚日志记录 files: # The directory where the log files will written to. # 指定日志路径 #path: /var/log/mybeat # The name of the files where the logs are written to. # 指定日志名称 #name: mybeat # Configure log file size limit. If limit is reached, log file will be # automatically rotated # 默认文件达到10M就会滚动生成新文件 rotateeverybytes:
# = 10MB # Number of rotated log files to keep. Oldest files will be deleted first. # 保留日志文件周期。 默认 7天。值范围为2 到 1024 #keepfiles: 7 # Enable debug output for selected components. To enable all selectors use ["*"] # Other available selectors are beat, publish, service # Multiple selectors can be chained. #selectors: [ ] # Sets log level. The default log level is error. # Available log levels are: critical, error, warning, info, debug # 日志级别，默认是error #level: error
阅读(...) 评论()}