tonglin0325的个人主页

Filebeat的http endpoint input

Filebeat的input终于支持了http,可以使用post请求向filebeat的input传输数据,不过现在还是处于beta版本

 

参考

1
2
https://www.elastic.co/guide/en/beats/filebeat/7.x/filebeat-input-http_endpoint.html

下载filebeat最新版本,然后解压

1
2
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.9.2-linux-x86_64.tar.gz

配置 filebeat_http.yml

1
2
3
4
5
6
7
8
9
10
11
filebeat.inputs:
- type: http_endpoint
enabled: true
listen_address: localhost
listen_port: 19080

#----------------------------------File output--------------------------------#
output.file:
path: "/tmp/filebeat"
filename: filebeat

给配置文件赋权

1
2
chmod go-w ./filebeat_http.yml

启动filebeat

1
2
./filebeat -e -c filebeat_http.yml

向19080端口发送post请求

1
2
3
curl -XPOST http://localhost:19080 -H 'Content-Type:application/json' -d'{"a":"b"}'
{"message": "success"}

不支持get请求

去/tmp/filebeat中查看

1
2
3
lintong@master:/tmp/filebeat$ tail -n 100 filebeat 
{"@timestamp":"2020-10-10T09:44:22.294Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.9.2"},"json":{"a":"b"},"input":{"type":"http_endpoint"},"ecs":{"version":"1.5.0"},"host":{"name":"master"},"agent":{"hostname":"master","ephemeral_id":"20bf06ed-3421-44b8-aeaf-bb5d54565eb3","id":"78e98f32-c8ce-4505-b75e-c98f373a2205","name":"master","type":"filebeat","version":"7.9.2"}}