搭建EFK架构
安装kafka：
https://blog.csdn.net/RoninLJH/article/details/107028599
安装filebeat：
https://blog.csdn.net/RoninLJH/article/details/107111943
安装ELK：
https://blog.csdn.net/RoninLJH/article/details/107006273

需要修改filebeat
[root@kafka01 ~]# vim /etc/filebeat/filebeat.yml
filebeat.inputs:

• type: log
  enabled: true
  paths: /var/log/messages
  fields:
  log_topics: messages

• type: log
  enabled: true
  paths: /var/log/nginx/access.log
  fields:
  log_topics: nginx
  output.kafka:
  enabled: true
  hosts: [“192.168.33.143:9092”,“192.168.33.144:9092”,“192.168.33.145:9092”]
  topic: ‘%{[fields][log_topics]}’
  需要修改nginx.conf

[root@kafka01 ~]# vim /etc/logstash/conf.d/nginx.conf
input {
kafka{
bootstrap_servers => [“192.168.33.143:9092,192.168.33.144:9092,192.168.33.145:9092”]
group_id => “logstash”
topics => “nginx”
consumer_threads => 5
}
}
filter {
json {
source => “message”
}
mutate {
remove_field => [“fields”,“prospector”,“host”,“log”]
}
grok {
match => {“message” => “%{NGINXACCESS}”}
}
}
output {
elasticsearch {
hosts => “192.168.33.144:9200”
index => “nginx_log-%{+YYYY.MM.dd}”
}

stdout {

codec => rubydebug

}

}