filebeat.yml

filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: true

processors:
  - add_cloud_metadata: ~
  - add_docker_metadata: ~

output.elasticsearch:
  hosts: '${ELASTICSEARCH_HOSTS:192.168.122.33:9200}'
  username: '${ELASTICSEARCH_USERNAME:elastic}'
  password: '${ELASTICSEARCH_PASSWORD:密码}'
  index: "ngx100-%{+yyyy.MM.dd}"

setup.template.name: "ngx100"
setup.template.pattern: "ngx100-%{+yyyy.MM.dd}"

modules.d/nginx-xx.yml

- module: nginx
  access:
    enabled: true
    var.paths: ["/dataN/ngx8/logs-A100/access-*.log"]

  error:
    enabled: true
    var.paths: ["/dataN/ngx8/logs-A100/error.log*"]

  ingress_controller:
    enabled: false

nginx-json版配置

使用 ndjson插件
https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html#drop-event-example

不使用modules.d
https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#_prospector_scanner_include_files

阿里云说明
https://developer.aliyun.com/article/887241

vim /etc/filebeat/filebeat.yml

filebeat.inputs:
- type: log
  enabled: true
  paths: 
    - /dataN/ngx8/logs-A100/access-*.log
    # - /dataN/ngx8/logs-A100/error.log  #错误日志不是json格式，解析出错误
  json.keys_under_root: true
  json.overwrite_keys: true