下面是可選的腳本模塊，可以自己選擇，然后進(jìn)行拼接，注意替換個(gè)性化的地方。

一、 從某個(gè)服務(wù)器下載安裝filebeat

1 將rpm包上傳至服務(wù)器A的</usr/local>路徑下

用scp
用sz
用sftp

2 從服務(wù)器A拉取rpm包

2.1 手動(dòng)輸入服務(wù)器A密碼

cd /usr/local/
filebeat=`ls | grep 'filebeat-7.7.0-x86_64.rpm'`
if [[ $filebeat == "" ]];then
    echo "--現(xiàn)在從中心服務(wù)器下載filebeat--"
    echo "--請(qǐng)輸入中心服務(wù)器密碼--"
    scp -o StrictHostKeyChecking=no root@192.168.18.3:/usr/local/filebeat-7.7.0-x86_64.rpm /usr/local/
else
    echo "--filebeat-7.7.0-x86_64.rpm已存在--"
fi
echo ""
ls -l | grep "filebeat"

2.2 自動(dòng)填入密碼

安裝expect
yum -y install expect

腳本1(/usr/local/download_filebeat.sh)

#!/usr/bin/expect
set timeout 30
spawn scp -o StrictHostKeyChecking=no root@192.168.18.3:/usr/local/filebeat-7.7.0-x86_64.rpm /usr/local/
expect "password:"
send "root"
interact

腳本2(/usr/local/install_filebeat.sh)

cd /usr/local/
filebeat=`ls | grep 'filebeat-7.7.0-x86_64.rpm'`
if [[ $filebeat == "" ]];then
    echo "--現(xiàn)在從中心服務(wù)器下載filebeat--"
    expect /usr/local/download_filebeat.sh
    echo "--下載完成--"
else
    echo "--filebeat-7.7.0-x86_64.rpm已存在--"
fi
echo ""
ls -l | grep "filebeat-7.7.0-x86_64.rpm"

二、 安裝filebeat

rpm -ivh ./filebeat-7.3.0-x86_64.rpm
cp /etc/filebeat/filebeat.yml{,.bak}

三、 修改filebeat輸出端為logstash

注意修改ip和端口

sed -i "s/output.elasticsearch:/#output.elasticsearch/" /etc/filebeat/filebeat.yml
sed -i "s/  hosts: \[\"localhost:9200\"\]/  #hosts: \[\"localhost:9200\"\]/" /etc/filebeat/filebeat.yml
sed -i "s/#output.logstash:/output.logstash:\n  hosts: \[\"192.168.18.3:5044\"\]/" /etc/filebeat/filebeat.yml

四、 收集linux的system日志（使用system模塊）

sed -i "s/^setup.kibana:/\nsetup.kibana:\n  host: \"192.168.18.3:5601\"\nsetup.template.overwrite: true\nsetup.template.enabled: true\nsetup.ilm.enabled: false\n/" /etc/filebeat/filebeat.yml
sed -i "s/  hosts: \[\"localhost:9200\"\]/  hosts: \[\"192.168.18.3:9200\"\]\n    indices:\n      - index: \"os-linux-%{+yyyy.MM.dd}\"\n        when.equals:\n          event:\n            module: \"system\"/" /etc/filebeat/filebeat.yml

filebeat modules enable system
#關(guān)閉syslog日志，只保留auth日志
sed -i "7 s/    enabled: true/    enabled: false/" /etc/filebeat/modules.d/system.yml