1.创建目录并创建yml文件

mkdir -p /usr/local/filebeat

cd /usr/local/filebeat

vim filebeat.yml

1).以下是配置文件 包含了es地址，索引.开发生产测试根据实地填写，及kibana地址

# ============================== Filebeat inputs ===============================
filebeat.inputs:
  - type: filestream
    enabled: true
    paths:
      - /var/lib/docker/containers/*/*.log
    parsers:
      - container:
      - multiline:
          type: pattern
          pattern: '^\d{2}:\d{2}:\d{2}\.\d{3}|^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}|^\['
          negate: true
          match: after
    scan_frequency: 10s
    close_inactive: 5m
    clean_inactive: 72h

processors:
  - add_docker_metadata:
      host: "unix:///var/run/docker.sock"
  - add_fields:
      target: ''
      fields:
        env: "master"              # 修改：baseline → master
        nodeIP: 10.0.1.133         # 修改：10.0.1.135 → 10.0.1.133
        environment: "master"      # 修改：baseline → master  开发
  - drop_event:
      when:
        equals:
          container.name: "filebeat-java-python"

# ============================== Output =======================================
output.elasticsearch:    # es地址
  hosts:
    - "11.0.16.3:9301"
    - "11.0.16.4:9301"
    - "10.254.254.134:9301"    

  indices:
    - index: "ai-master-logs-%{+yyyy.MM.dd}"  # 修改：baseline → master 这是索引， 开发
      when.equals:
        env: "master"                           # 修改：baseline → master

# ============================== Setup ========================================
setup.kibana:
  host: "10.0.1.109:5601"

setup.template:
  enabled: true
  name: "ai-master-logs"         # 修改：baseline → master 索引
  pattern: "ai-master-logs-*"    # 修改：baseline → master 索引

# ============================== Logging ======================================
logging.level: info
logging.to_files: true
logging.files:
  path: /usr/share/filebeat/logs
  name: filebeat
  keepfiles: 7
  permissions: 0644

# ============================== Performance ==================================
queue.mem:
  events: 4096
  flush.min_events: 2048
  flush.timeout: 5s

2).以上编辑好启动以下命令：

docker run -d \
  --name elasticsearch \
  --net host \
  -e "ES_JAVA_OPTS=-Xms512m -Xmx512m" \
  -e "discovery.type=multi-node" \
  -v /data/elasticsearch/config/elasticsearch.yml:/usr/share/elasticsearch/config/elasticsearch.yml \
  -v /data/elasticsearch/data:/usr/share/elasticsearch/data \
  -v /data/elasticsearch/logs:/usr/share/elasticsearch/logs \
  --restart unless-stopped \
  elasticsearch-ik:9.0.2