1、下载安装程序

下载地址：Download Filebeat • Lightweight Log Analysis | Elastic

2、安装filebeat

rpm -ivh filebeat-7.9.3-x86_64.rpm

3、安装目录说明

 4、修改配置文件

cat /etc/filebeat/filebeat.yml

filebeat.inputs:
- type: logenabled: truepaths:- /var/log/secure
output.elasticsearch:hosts:- "192.168.1.10:9200"- "192.168.1.11:9200"- "192.168.1.12:9200"

5、启动 filebeat

#设置开机自启
systemctl enable filebeat.service#启动filebeat
systemctl start filebeat.service

 检测启动是否正常：

ps -ef |grep filebeat

root 78082 1 0 08:57 ? 00:00:00 /usr/share/filebeat/bin/filebeat 
--environment systemd -c /etc/filebeat/filebeat.yml 
--path.home /usr/share/filebeat 
--path.config /etc/filebeat 
--path.data /var/lib/filebeat 
--path.logs /var/log/filebeat