filebeat  8.13.3
https://www.elastic.co/downloads/beats/filebeat
https://www.elastic.co/downloads/past-releases/filebeat-8-13-3

在 macOS 系统中，Filebeat 针对不同架构（x86_64 和 aarch64）提供了相应的安装包
x86_64（Intel/AMD 架构）：
即常见的 64 位 x86 架构，适用于采用 Intel 或 AMD 处理器的 macOS 设备（如早期的 MacBook Pro/Air、iMac 等）
aarch64（ARM 架构）：
即 ARM 64 位架构，适用于 Apple 自研的 M 系列芯片（如 M1、M2、M3 等）的 macOS 设备（如 2020 年后发布的 MacBook、Mac mini 等）




日志抓取关键配置 

include_lines: ['keyword001','keyword002']
抓取包含 keyword001 或 keyword002 日志行

filebeat.config.modules.path: /path/filebeat8.13.3/modules.d/*.yml
配置 filebeat 安装目录 

output.kafka.hosts
配置 kafka 







完整配置 

filebeat.idle_timeout: 2s
filebeat.name: filebeat-shiper
filebeat.spool_size: 50000
filebeat.inputs:
- type: log
  paths:
   - /path/logs/fbtest/*.log
  include_lines: ['keyword001','keyword002']
  fields:
    topic: topic-001
  enabled: true
  backoff: 1s
  backoff_factor: 2
  close_inactive: 1h
  encoding: plain
  harvester_buffer_size: 262144
  max_backoff: 10s
  max_bytes: 10485760
  scan_frequency: 60s
  tail_files: true
setup.ilm.enabled: false
filebeat.config.modules:
  path: /path/filebeat8.13.3/modules.d/*.yml
  reload.enabled: true
  reload.period: 60s
setup.kibana:
output.kafka:
  bulk_flush_frequency: 0
  bulk_max_size: 2048
  codec.format:
    string: '%{[message]}'
  compression: gzip
  compression_level: 4
  hosts:
  - 192.168.1.10:9092
  - 192.168.1.10:9092
  - 192.168.1.10:9092
  max_message_bytes: 10485760
  partition.round_robin:
    reachable_only: true
  required_acks: 1
  topic: '%{[fields.topic]}'
  workers: 4
processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~





启动日志采集 

./filebeat -c /path/filebeat/config.yml



模拟写入日志 

echo '{"id":"11"}' >> /path/logs/fbtest/001.log
echo 'keyword002 : {"id":"12"}' >> /path/logs/fbtest/001.log
echo 'keyword002 : {"id":"13"}' >> /path/logs/fbtest/001.log
echo 'keyword002 : {"id":"14"}' >> /path/logs/fbtest/001.log
echo 'keyword001 : {"id":"15"}' >> /path/logs/fbtest/001.log
echo 'keyword001 : {"id":"16"}' >> /path/logs/fbtest/001.log
echo 'keyword001 : {"id":"17"}' >> /path/logs/fbtest/001.log
echo '{"id":"18"}' >> /path/logs/fbtest/001.log
echo '{"id":"19"}' >> /path/logs/fbtest/001.log