需要注意的是多行转换的区块要写在filebeat.prospectors内. 和paths保持一致. 不能顶行写,不然就会不生效. ``` filebeat.prospectors: - type: log enabled: true paths: - /root/log/php.log multiline.pattern: '^\d{4}\-\d{2}\-\d{2}' multiline.negate: true multiline.match: after filebeat.config.modules: path: ${path.config}/modules.d/*.yml reload.enabled: false setup.template.settings: index.number_of_shards: 3 setup.kibana: output.elasticsearch: hosts: ["192.168.47.13:9200"] ``` ``` output.elasticsearch: # Array of hosts to connect to. hosts: ["localhost:9200"] index: "api-access-%{+yyyy.MM.dd}" setup.template: name: 'api-access' pattern: 'api-access-*' enabled: false ```