1.下載rpm二進制包
#wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.2.3-x86_64.rpm
2.安裝
#rpm -ivh filebeat-6.2.3-x86_64.rpm
3.修改主配置文件該步驟同tar包，查詢配置文件的路徑可通過
[root@test system]# rpm -ql filebeat | more /etc/filebeat/fields.yml /etc/filebeat/filebeat.reference.yml /etc/filebeat/filebeat.yml /etc/filebeat/modules.d/apache2.yml.disabled /etc/filebeat/modules.d/auditd.yml.disabled /etc/filebeat/modules.d/icinga.yml.disabled /etc/filebeat/modules.d/kafka.yml.disabled /etc/filebeat/modules.d/logstash.yml.disabled /etc/filebeat/modules.d/mysql.yml.disabled /etc/filebeat/modules.d/nginx.yml.disabled /etc/filebeat/modules.d/osquery.yml.disabled /etc/filebeat/modules.d/postgresql.yml.disabled /etc/filebeat/modules.d/redis.yml.disabled /etc/filebeat/modules.d/system.yml.disabled /etc/filebeat/modules.d/traefik.yml.disabled /etc/init.d/filebeat /lib/systemd/system/filebeat.service /usr/bin/filebeat /usr/share/filebeat/.build_hash.txt /usr/share/filebeat/LICENSE.txt /usr/share/filebeat/NOTICE.txt /usr/share/filebeat/README.md /usr/share/filebeat/bin/filebeat /usr/share/filebeat/bin/filebeat-god /usr/share/filebeat/kibana/5/dashboard/0d3f2380-fa78-11e6-ae9b-81e5311e8cab.json /usr/share/filebeat/kibana/5/dashboard/26309570-2419-11e7-a83b-d5f4cebac9ff.json /usr/share/filebeat/kibana/5/dashboard/277876d0-fa2c-11e6-bbd3-29c986c96e5a.json /usr/share/filebeat/kibana/5/dashboard/5517a150-f9ce-11e6-8115-a7c18106d86a.json /usr/share/filebeat/kibana/5/dashboard/7fea2930-478e-11e7-b1f0-cb29bac6bf8b.json /usr/share/filebeat/kibana/5/dashboard/Filebeat-Apache2-Dashboard.json /usr/share/filebeat/kibana/5/dashboard/Filebeat-MySQL-Dashboard.json /usr/share/filebeat/kibana/5/dashboard/Filebeat-Nginx-Dashboard.json /usr/share/filebeat/kibana/5/dashboard/Filebeat-Traefik-Dashboard.json /usr/share/filebeat/kibana/5/dashboard/Filebeat-syslog-dashboard.json /usr/share/filebeat/kibana/5/dashboard/ML-Nginx-Access-Remote-IP-Count-Explorer.json /usr/share/filebeat/kibana/5/dashboard/ML-Nginx-Remote-IP-URL-Explorer.json /usr/share/filebeat/kibana/5/dashboard/ML-Traefik-Access-Remote-IP-Count-Explorer.json /usr/share/filebeat/kibana/5/dashboard/ML-Traefik-Remote-IP-URL-Explorer.json /usr/share/filebeat/kibana/5/dashboard/b9163ea0-2417-11e7-a83b-d5f4cebac9ff.json /usr/share/filebeat/kibana/5/dashboard/dfbb49f0-0a0f-11e7-8a62-2d05eaaac5cb.json /usr/share/filebeat/kibana/5/dashboard/f693d260-2417-11e7-a83b-d5f4cebac9ff.json /usr/share/filebeat/kibana/5/index-pattern/filebeat.json /usr/share/filebeat/kibana/5/search/0ab87b80-478e-11e7-b1f0-cb29bac6bf8b.json --More-- .........................
4.以系統服務方式啟動filebeat
#systemctl enable filebeat.service --設置服務開機自啟動 #systemctl start filebeat.service --啟動服務