filbeat篇章——overview

https://www.elastic.co/guide/en/beats/filebeat/8.7/filebeat-overview.html#filebeat-overview

Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing.

Filebeat 是一个轻量级的日志收集器，用于将日志数据转发和集中管理。它作为一个代理程序安装在你的服务器上，监控你指定的日志文件或位置，收集日志事件，并将它们转发到 Elasticsearch 或 Logstash 进行索引。

Here’s how Filebeat works: When you start Filebeat, it starts one or more inputs that look in the locations you’ve specified for log data. For each log that Filebeat locates, Filebeat starts a harvester. Each harvester reads a single log for new content and sends the new log data to libbeat, which aggregates the events and sends the aggregated data to the output that you’ve configured for Filebeat.

这是 Filebeat 的工作原理：当你启动 Filebeat 时，它会启动一个或多个input，这些input会查找你指定的日志数据位置。对于 Filebeat 发现的每个日志文件，它都会启动一个 harvester。每个 harvester 读取一个日志文件的新内容，并将新的日志数据发送到 libbeat，libbeat 聚合事件并将聚合后的数据发送到你为 Filebeat 配置的输出。