Filebeat的http endpoint input

Filebeat的input終於支持了http，可以使用post請求向filebeat的input傳輸數據，不過現在還是處於beta版本

 

參考

https://www.elastic.co/guide/en/beats/filebeat/7.x/filebeat-input-http_endpoint.html

下載filebeat最新版本，然后解壓

wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.9.2-linux-x86_64.tar.gz

配置 filebeat_http.yml

filebeat.inputs:
- type: http_endpoint
  enabled: true
  listen_address: localhost
  listen_port: 19080

#----------------------------------File output--------------------------------#
output.file:
  path: "/tmp/filebeat"
  filename: filebeat

給配置文件賦權

chmod go-w ./filebeat_http.yml

啟動filebeat

./filebeat -e -c filebeat_http.yml

向19080端口發送post請求

curl -XPOST http://localhost:19080 -H 'Content-Type:application/json' -d'{"a":"b"}'
{"message": "success"}

不支持get請求

去/tmp/filebeat中查看

lintong@master:/tmp/filebeat$ tail -n 100 filebeat 
{"@timestamp":"2020-10-10T09:44:22.294Z","@metadata":{"beat":"filebeat","type":"_doc","version":"7.9.2"},"json":{"a":"b"},"input":{"type":"http_endpoint"},"ecs":{"version":"1.5.0"},"host":{"name":"master"},"agent":{"hostname":"master","ephemeral_id":"20bf06ed-3421-44b8-aeaf-bb5d54565eb3","id":"78e98f32-c8ce-4505-b75e-c98f373a2205","name":"master","type":"filebeat","version":"7.9.2"}}