Filebeat之input和output（包含Elasticsearch Output 、Logstash Output、 Redis Output、 Fil

ahua671

).　　# Some sample encodings:
　　#   plain, utf-8, utf-16be-bom, utf-16be, utf-16le, big5, gb18030, gbk,
　　#    hz-gb-2312, euc-kr, euc-jp, iso-2022-jp, shift-jis, ...
　　#encoding: plain
　　# Type of the files. Based on this the way the file is read is decided.
　　# The different types cannot be mixed in one prospector
　　#
　　# Possible options are:
　　# * log: Reads every line of the log file (default)
　　# * stdin: Reads the standard in
　　input_type: log
　　# Exclude lines. A list of regular expressions to match. It drops the lines that are
　　# matching any regular expression from the list. The include_lines is called before
　　# exclude_lines. By default, no lines are dropped.
　　# exclude_lines: ["^DBG"]
　　# Include lines. A list of regular expressions to match. It exports the lines that are
　　# matching any regular expression from the list. The include_lines is called before
　　# exclude_lines. By default, all the lines are exported.
　　# include_lines: ["^ERR", "^WARN"]
　　# Exclude files. A list of regular expressions to match. Filebeat drops the files that
　　# are matching any regular expression from the list. By default, no files are dropped.
　　# exclude_files: [".gz$"]
　　# Optional additional fields. These field can be freely picked
　　# to add additional information to the crawled log files for filtering
　　#fields:
　　#  level: debug
　　#  review: 1
　　# Set to true to store the additional fields as top level fields instead
　　# of under the "fields" sub-dictionary. In case of name conflicts with the
　　# fields added by Filebeat itself, the custom fields overwrite the default
　　# fields.
　　#fields_under_root: false
　　# Ignore files which were modified more then the defined timespan in the past.
　　# In case all files on your system must be read you can set this value very large.
　　# Time strings like 2h (2 hours), 5m (5 minutes) can be used.
　　#ignore_older: 0
　　# Close older closes the file handler for which were not modified
　　# for longer then close_older
　　# Time strings like 2h (2 hours), 5m (5 minutes) can be used.
　　#close_older: 1h
　　# Type to be published in the 'type' field. For Elasticsearch output,
　　# the type defines the document type these entries should be stored
　　# in. Default: log
　　#document_type: log
　　# Scan frequency in seconds.
　　# How often these files should be checked for changes. In case it is set
　　# to 0s, it is done as often as possible. Default: 10s
　　#scan_frequency: 10s

　　# Defines the buffer>　　#harvester_buffer_size: 16384
　　# Maximum number of bytes a single log event can have
　　# All bytes after max_bytes are discarded and not sent. The default is 10MB.
　　# This is especially useful for multiline log messages which can get large.
　　#max_bytes: 10485760
　　# Mutiline can be used for log messages spanning multiple lines. This is common
　　# for Java Stack Traces or C-Line Continuation
　　#multiline:
　　# The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
　　#pattern: ^\[
　　# Defines if the pattern set under pattern should be negated or not. Default is false.
　　#negate: false
　　# Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
　　# that was (not) matched before or after or as long as a pattern is not matched based on negate.
　　# Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
　　#match: after
　　# The maximum number of lines that are combined to one event.
　　# In case there are more the max_lines the additional lines are discarded.
　　# Default is 500
　　#max_lines: 500
　　# After the defined timeout, an multiline event is sent even if no new pattern was found to start a new event
　　# Default is 5s.
　　#timeout: 5s
　　# Setting tail_files to true means filebeat starts readding new files at the end
　　# instead of the beginning. If this is used in combination with log rotation
　　# this can mean that the first entries of a new file are skipped.
　　#tail_files: false
　　# Backoff values define how agressively filebeat crawls new files for updates
　　# The default values can be used in most cases. Backoff defines how long it is waited
　　# to check a file again after EOF is reached. Default is 1s which means the file
　　# is checked every second if new lines were added. This leads to a near real time crawling.
　　# Every time a new line appears, backoff is reset to the initial value.
　　#backoff: 1s
　　# Max backoff defines what the maximum backoff time is. After having backed off multiple times

　　# from checking the files, the waiting time will never exceed max_backoff>　　# backoff factor. Having it set to 10s means in the worst case a new line can be added to a log
　　# file after having backed off multiple times, it takes a maximum of 10s to read the new line
　　#max_backoff: 10s
　　# The backoff factor defines how fast the algorithm backs off. The bigger the backoff factor,
　　# the faster the max_backoff value is reached. If this value is set to 1, no backoff will happen.
　　# The backoff value will be multiplied each time with the backoff_factor until max_backoff is reached
　　#backoff_factor: 2
　　# This option closes a file, as soon as the file name changes.
　　# This config option is recommended on windows only. Filebeat keeps the files it's reading open. This can cause
　　# issues when the file is removed, as the file will not be fully removed until also Filebeat closes
　　# the reading. Filebeat closes the file handler after ignore_older. During this time no new file with the
　　# same name can be created. Turning this feature on the other hand can lead to loss of data
　　# on rotate files. It can happen that after file rotation the beginning of the new
　　# file is skipped, as the reading starts at the end. We recommend to leave this option on false

　　# but lower the ignore_older value to>　　#force_close_files: false
　　# Additional prospector
　　#-
　　# Configuration to use stdin input
　　#input_type: stdin
　　# General filebeat configuration options
　　#
　　# Event count spool threshold - forces network flush if exceeded
　　#spool_size: 2048
　　# Enable async publisher pipeline in filebeat (Experimental!)
　　#publish_async: false

　　# Defines how often the spooler is flushed. After>　　# Flush even though spool_size is not reached.
　　#idle_timeout: 5s
　　# Name of the registry file. Per default it is put in the current working
　　# directory. In case the working directory is changed after when running
　　# filebeat again, indexing starts from the beginning again.
　　#registry_file: .filebeat
　　# Full Path to directory with additional prospector configuration files. Each file must end with .yml
　　# These config files must have the full filebeat config part inside, but only
　　# the prospector part is processed. All global options like spool_size are ignored.
　　# The config_dir MUST point to a different directory then where the main filebeat config file is in.
　　#config_dir:
　　###############################################################################
　　############################# Libbeat Config ##################################
　　# Base config file used by all other beats for using libbeat features
　　############################# Output ##########################################
　　# Configure what outputs to use when sending the data collected by the beat.
　　# Multiple outputs may be used.
　　output:
　　### Elasticsearch as output
　　#elasticsearch:
　　# Array of hosts to connect to.
　　# Scheme and port can be left out and will be set to the default (http and 9200)
　　# In case you specify and additional path, the scheme is required: