ES集群地址
10.0.0.91:9200
10.0.0.92:9200
10.0.0.93:9200
启用模块
root@elk92:~# filebeat modules enable mongodb
修改模块配置文件
#由于是采用二进制部署的MySQL，所以要制定日志目录
root@elk93:~# vim /etc/filebeat/modules.d/mongodb.yml# Module: mongodb
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.17/filebeat-module-mongodb.html- module: mongodb# All logslog:enabled: true# Set custom paths for the log files. If left empty,# Filebeat will choose the paths depending on your OS.var.paths: ["/mongodb/log/*.log"]
Filebeat实例
root@elk92:~# vim /etc/filebeat/config/08-modules-mongodb-to-es.yaml
filebeat.config.modules:path: ${path.config}/modules.d/mongodb.ymlreload.enabled: trueoutput.elasticsearch:hosts:- 10.0.0.91:9200- 10.0.0.92:9200- 10.0.0.93:9200index: dezyan-modules-mongodb-%{+yyyy.MM.dd}setup.ilm.enabled: false
setup.template.name: "dezyan"
setup.template.pattern: "dezyan-*"
setup.template.overwrite: true
setup.template.settings:index.number_of_shards: 5index.number_of_replicas: 0root@elk92:~# filebeat -e -c /etc/filebeat/config/08-modules-mongodb-to-es.yaml
