filebeat+logstash通過zabbix微信報警

一、安裝軟件：

1、在要收集日志的機器上安裝filebeat：

1)、下載安裝：
cd /usr/local/src
wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.3.3-linux-x86_64.tar.gz
tar xvf filebeat-5.3.3-linux-x86_64.tar.gz -C /usr/local
rm -f filebeat-5.3.3-linux-x86_64.tar.gz

2）、增加配置文件：
mkdir -p /etc/filebeat

cat >/etc/filebeat/filebeat.yml << EOF filebeat.prospectors:
- input_type: log
  paths:
    - /usr/local/wintel400/log/*.log
  fields:
    document_type: CTI02-wintel-log
  tail_files: true
  ignore_olde: 24h
output.logstash:
  hosts: ["192.168.22.214:5044"] EOF
注：增加各客戶端的配置文件時修改document_type的值，還有日志收集的目錄。 

3)、啟動（調試時可以用前台啟動）： 
/usr/local/filebeat-5.3.3-linux-x86_64/filebeat -e -c /etc/filebeat/filebeat.yml
nohup /usr/local/filebeat-5.3.3-linux-x86_64/filebeat -e -c /etc/filebeat/filebeat.yml 

2、安裝logstash：

1)、安裝logstash（需要安裝java1.8）：
cd /usr/local/src
wget https://artifacts.elastic.co/downloads/logstash/logstash-5.3.3.tar.gz
tar zxf logstash-5.3.3.tar.gz  -C /usr/local/ 
rm -f /logstash-5.3.3.tar.gz

2)、增加配置文件：
mkdir /etc/logstash    配置文件見下面

3)、啟動（調試時先用前台啟動）：
/usr/local/logstash-5.3.3/bin/logstash -f /etc/logstash/
nohup /usr/local/logstash-5.3.3/bin/logstash -f /etc/logstash/ &

java1.8下載:
wget --no-cookies --no-check-certificate --header "Cookie: gpw_e24=http%3A%2F%2Fwww.oracle.com%2F; oraclelicense=accept-securebackup-cookie" "http://download.oracle.com/otn-pub/java/jdk/8u171-b11/512cd62ec5174c3487ac17c61aaa89e8/jdk-8u171-linux-x64.tar.gz"

logstash的配置文件：

input {beats  {port => 5045}}
filter {if [fields][document_type] == "WEB01-easycti-log" {
             mutate {
             add_field => [ "[@metadata][zabbix_key]" , "EasyctiLog" ]
             add_field => [ "[@metadata][zabbix_host]" , "HAI--WEB01" ]
             }
         }
         else if [fields][document_type] == "WEB02-easycti-log" {
             mutate {
             add_field => [ "[@metadata][zabbix_key]" , "EasyctiLog" ]
             add_field => [ "[@metadata][zabbix_host]" , "HAI--WEB02" ]
             }
         }
         else if [fields][document_type] == "WEB03-easycti-log" {
             mutate {
             add_field => [ "[@metadata][zabbix_key]" , "EasyctiLog" ]
             add_field => [ "[@metadata][zabbix_host]" , "HAI--WEB03" ]
             }
         }
         grok {
                  match => {
                  "message" => "\[%{GREEDYDATA:logtime}\] %{DATA:context}\.%{WORD:level}: %{GREEDYDATA:msg}"
                  }
         }
}
output {
        if [level] =~ /(ERR|error|ERROR)/ {
                zabbix {
                zabbix_host => "[@metadata][zabbix_host]"
                zabbix_key => "[@metadata][zabbix_key]"
                zabbix_server_host => "192.168.22.216"
                zabbix_server_port => "10051"
                zabbix_value => "message"
                }
                stdout { codec => rubydebug }
        }
}

input {beats  {port => 5044}}

filter { if [fields][document_type] == "CTI01-wintel-log" {
             mutate {
             add_field => [ "[@metadata][zabbix_key]" , "WintelLog" ]
             add_field => [ "[@metadata][zabbix_host]" , "HAI--CTI01" ]
             }
         }
         else if [fields][document_type] == "CTI02-wintel-log" {
             mutate {
             add_field => [ "[@metadata][zabbix_key]" , "WintelLog" ]
             add_field => [ "[@metadata][zabbix_host]" , "HAI--CTI02" ]
             }
         }
        grok {
                  match => {
                  "message" => "%{GREEDYDATA:logtime} \[%{WORD:level}] %{GREEDYDATA:msg}"
                  }
         }
}
output {
        if [level] =~ /(ERR|WARNING)/ {
                zabbix {
                zabbix_host => "[@metadata][zabbix_host]"
                zabbix_key => "[@metadata][zabbix_key]"
                zabbix_server_host => "192.168.22.216"
                zabbix_server_port => "10051"
                zabbix_value => "message"
                }
                stdout { codec => rubydebug }
        }
}

 二、配置zabbix：

 配置微信告警參考：http://www.cnblogs.com/kevingrace/p/5995875.html

1、配置zabbix，獲取logstash發過來的日志：

1)、依次創建模板，應用集，監控項，觸發器。

2)、創建應用集：

3)、創建監控項：

 

4)、創建觸發器：