>[info] **官网：**[https://www.elastic.co/cn/products/beats/filebeat](https://www.elastic.co/cn/products/beats/filebeat) [TOC] ### 1 从官网下载 [https://www.elastic.co/cn/downloads/beats/filebeat](https://www.elastic.co/cn/downloads/beats/filebeat) ### 2 修改配置文件filebeat.yml #### 2.1 修改filebeat.inputs 为以下内容，其中paths为项目的日志路径 ~~~ filebeat.inputs: - type: log enabled: true paths: - /docker/logs/application/*/*.log exclude_lines: ['\sDEBUG\s\d'] exclude_files: ['sc-admin.*.log$'] fields: docType: sys-log project: pigframe multiline: pattern: '^\[\S+:\S+:\d{2,}] ' negate: true match: after - type: log enabled: true paths: - /docker/logs/point/*.log fields: docType: point-log project: pigframe ~~~ #### 2.2 修改output.logstash为以下内容，其中hosts为logstash的部署地址 ~~~ hosts: ["192.168.28.130:5044"] bulk_max_size: 2048 ~~~ ### 3. 启动Filebeat ~~~ ./filebeat -c filebeat.yml -e ~~~