Beats：负责收集系统数据，可以直接发送到es中，也可以通过logstash中转
    logstash：收集日志，为beats提供中转功能
    Elasticsearch：提供数据存储，服务端聚合计算功能
    Kibana：提供炫丽的可视化图形展示并且作为elasticsearch的搜索的小清新客户端

$ ls -F
LICENSE.txt            metricbeat*
NOTICE.txt            metricbeat.reference.yml
README.md            metricbeat.yml
data/                metricbeat.yml.org
fields.yml            module/
kibana/                modules.d/
logs/

metricbeat.yml：这是一个默认的配置文件
metricbeat.reference.yml：这是一个完整的样本配置文件

# 路径：metricbeat-7.3.2-darwin-x86_64/modules.d
# ls -a
.                    kibana-xpack.yml.disabled
..                    kibana.yml.disabled
aerospike.yml.disabled            kubernetes.yml.disabled
apache.yml.disabled            kvm.yml.disabled
aws.yml.disabled            logstash-xpack.yml.disabled
beat-xpack.yml.disabled            logstash.yml.disabled
beat.yml.disabled            memcached.yml.disabled
ceph.yml.disabled            mongodb.yml.disabled
cockroachdb.yml.disabled        mssql.yml.disabled
consul.yml.disabled            munin.yml.disabled
coredns.yml.disabled            mysql.yml.disabled
couchbase.yml.disabled            nats.yml.disabled
couchdb.yml.disabled            nginx.yml.disabled
docker.yml.disabled            oracle.yml.disabled
dropwizard.yml.disabled            php_fpm.yml.disabled
elasticsearch-xpack.yml.disabled    postgresql.yml.disabled
elasticsearch.yml.disabled        prometheus.yml.disabled
envoyproxy.yml.disabled            rabbitmq.yml.disabled
etcd.yml.disabled            redis.yml.disabled
golang.yml.disabled            system.yml
graphite.yml.disabled            traefik.yml.disabled
haproxy.yml.disabled            uwsgi.yml.disabled
http.yml.disabled            vsphere.yml.disabled
jolokia.yml.disabled            windows.yml.disabled
kafka.yml.disabled            zookeeper.yml.disabled

./metricbeat modules list

./metricbeat modules enable apache mysql

./metricbeat modules disable apache mysql

output.elasticsearch
  hosts: ["127.0.0.1:9200"]

setup.kibana:
  host: "127.0.0.1:5601"

output.elasticsearch:
  hosts: ["myEShost:9200"]
  username: "filebeat_internal"
  password: "YOUR_PASSWORD"
setup.kibana:
  host: "mykibanahost:5601"
  username: "my_kibana_user"
  password: "YOUR_PASSWORD"

./metricbeat test config -e

./metricbeat setup

$ ./metricbeat setup
Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards

./metricbeat -e

input {
  beats {
    port => 5044
    client_inactivity_timeout => 36000
  }
}

output {
  elasticsearch {
    hosts => ["http://192.168.28.110:9201"]
    index => "myindex-elk"
  }
}

#=========================== Filebeat inputs =============================
 
filebeat.inputs:
 
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
 
- type: log
 
  # Change to true to enable this input configuration.
  enabled: true
 
  # Paths that should be crawled and fetched. Glob based paths.
  paths:  #配置多个日志路径
    - /usr/local/programs/elasticsearch-7.6.2/logs/jcc_es_cluster.log

    #- c:\programdata\elasticsearch\logs\*
 
  # Exclude lines. A list of regular expressions to match. It drops the lines that are
  # matching any regular expression from the list.
  #exclude_lines: ['^DBG']
 
  # Include lines. A list of regular expressions to match. It exports the lines that are
  # matching any regular expression from the list.
  #include_lines: ['^ERR', '^WARN']
 
  # Exclude files. A list of regular expressions to match. Filebeat drops the files that
  # are matching any regular expression from the list. By default, no files are dropped.
  #exclude_files: ['.gz$']
 
  # Optional additional fields. These fields can be freely picked
  # to add additional information to the crawled log files for filtering
  #fields:
  #  level: debug
  #  review: 1
 
  ### Multiline options
 
  # Multiline can be used for log messages spanning multiple lines. This is common
  # for Java Stack Traces or C-Line Continuation
 
  # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
  #multiline.pattern: ^\[
 
  # Defines if the pattern set under pattern should be negated or not. Default is false.
  #multiline.negate: false
 
  # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
  # that was (not) matched before or after or as long as a pattern is not matched based on negate.
  # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
  #multiline.match: after
 
 
#================================ Outputs =====================================
 
#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts #配多个logstash使用负载均衡机制
  hosts: ["192.168.28.110:5044"]  
  loadbalance: true  #使用了负载均衡
 
  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
 
  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"
 
  # Client Certificate Key

elasticsearch.hosts: ["http://192.168.28.110:9201"]

./elasticsearch

./logstash -f ../config/logstash-sample2.conf --config.reload.automatic

./filebeat -e   #启动filebeat

GET /myindex-elk/_doc/_search
{
  "query":{
    "match_all": {}
  }
}

Caused by: java.lang.RuntimeException: can not run elasticsearch as root
        at org.elasticsearch.bootstrap.Bootstrap.initializeNatives(Bootstrap.java:105) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:172) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:349) ~[elasticsearch-7.6.2.jar:7.6.2]
        at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:170) ~[elasticsearch-7.6.2.jar:7.6.2]
        ... 6 more

{
  "took" : 5,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 39,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "myindex-elk",
        "_type" : "_doc",
        "_id" : "aXZYt4cBE_wIwe2ICjz2",
        "_score" : 1.0,
        "_source" : {
          "log" : {
            "file" : {
              "path" : "/usr/local/programs/elasticsearch-7.6.2/logs/jcc_es_cluster.log"
            },
            "offset" : 0
          },
          "input" : {
            "type" : "log"
          },
          "host" : {
            "name" : "localhost.localdomain"
          },
          "agent" : {
            "ephemeral_id" : "ae3a76de-3fc7-45a6-b8af-bc6816b052a5",
            "hostname" : "localhost.localdomain",
            "id" : "178a306f-78f7-49cc-8b18-0526d639b9b0",
            "version" : "7.6.1",
            "type" : "filebeat"
          },
          "ecs" : {
            "version" : "1.4.0"
          },
          "tags" : [
            "beats_input_codec_plain_applied"
          ],
          "@version" : "1",
          "message" : "[2023-04-25T15:06:08,093][ERROR][o.e.b.Bootstrap          ] [es_node_01] Exception",
          "@timestamp" : "2023-04-25T07:36:51.981Z"
        }
      }

2023-04-25T15:36:37.136+0800    INFO    log/harvester.go:324    File is inactive: /usr/local/programs/elasticsearch-7.6.2/logs/jcc_es_cluster.log. Closing because close_inactive of 5m0s reached