下载并安装filebeat
##### 下载filebeat的rpm包
[root@online-webser01 softwares]# wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.2.1-x86_64.rpm
--2018-06-14 12:12:39-- https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.2.1-x86_64.rpm
Resolving artifacts.elastic.co (artifacts.elastic.co)... 54.235.171.120, 107.21.237.188, 184.73.245.233, ...
Connecting to artifacts.elastic.co (artifacts.elastic.co)|54.235.171.120|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 12697093 (12M) [binary/octet-stream]
Saving to: ‘filebeat-6.2.1-x86_64.rpm’
100%[==========================================================================================================================================================================================================================>] 12,697,093 88.6KB/s in 2m 18s
2018-06-14 12:15:03 (89.6 KB/s) - ‘filebeat-6.2.1-x86_64.rpm’ saved [12697093/12697093]
##### 安装filebeat
[root@online-webser01 softwares]# rpm -ivh filebeat-6.2.1-x86_64.rpm
warning: filebeat-6.2.1-x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID d88e42b4: NOKEY
Preparing... ################################# [100%]
Updating / installing...
1:filebeat-6.2.1-1 ################################# [100%]
[root@online-webser01 softwares]# systemctl status filebeat.service
● filebeat.service - filebeat
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled)
Active: inactive (dead)
Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html
##### 启动filebeat服务
[root@online-webser01 softwares]# systemctl start filebeat.service
[root@online-webser01 softwares]# systemctl status filebeat.service
● filebeat.service - filebeat
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled)
Active: active (running) since Thu 2018-06-14 12:16:14 CST; 3s ago
Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html
Main PID: 5727 (filebeat)
CGroup: /system.slice/filebeat.service
└─5727 /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
Jun 14 12:16:14 online-webser01 systemd[1]: Started filebeat.
Jun 14 12:16:14 online-webser01 systemd[1]: Starting filebeat...
[root@online-webser01 softwares]#
[root@online-webser03 softwares]# ps -ef | grep filebeat
root 30558 1 0 12:18 ? 00:00:00 /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
参考：https://www.jianshu.com/p/b7245ce58c6a
http://8p6.d3dd.cn/3zob8g1/2fbea_21012.html
