filebeat yum install

# yum install filebeat

## filebeat install method

# wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.8.3-linux-x86_64.tar.gz
    
    # wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.8.3-x86_64.rpm
    
    # wget https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.8.3-i686.rpm
    
    # yum localinstall filebeat-6.8.3-i686.rpm / filebeat-6.8.3-x86_64.rpm
    
    
## edit filebeat boot 
 
    # vim /etc/filebeat/filebeat.yml
 
 
 
 ```bash
 
 filebeat.inputs:
- type: log
  enabled: true
  paths:
    #- /var/log/*.log
    - /var/log/njmon/*.json
    - /var/log/nginx/*.log
    #- c:\programdata\elasticsearch\logs\*
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false
setup.template.settings:
  index.number_of_shards: 3
setup.kibana:
output.redis:
  hosts: ["10.x.x.x"]
  port: 6379
  key: "nginx-log"
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  
```

---

filebeat init.d boot script

```bash
cat /etc/init.d/filebeat 
#!/bin/bash
#
# filebeat          filebeat shipper
#
# chkconfig: 2345 98 02
# description: Starts and stops a single filebeat instance on this system
#

### BEGIN INIT INFO
# Provides:          filebeat
# Required-Start:    $local_fs $network $syslog
# Required-Stop:     $local_fs $network $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Filebeat sends log files to Logstash or directly to Elasticsearch.
# Description:       Filebeat is a shipper part of the Elastic Beats
#                    family. Please see: https://www.elastic.co/products/beats
### END INIT INFO

PATH=/usr/bin:/sbin:/bin:/usr/sbin
export PATH

[ -f /etc/sysconfig/filebeat ] && . /etc/sysconfig/filebeat
pidfile=${PIDFILE-/var/run/filebeat.pid}
agent=${BEATS_AGENT-/usr/share/filebeat/bin/filebeat}
args="-c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat"
test_args="-e test config"
beat_user="${BEAT_USER:-root}"
wrapper="/usr/share/filebeat/bin/filebeat-god"
wrapperopts="-r / -n -p $pidfile"
user_wrapper="su"
user_wrapperopts="$beat_user -c"
RETVAL=0

# Source function library.
. /etc/rc.d/init.d/functions

# Determine if we can use the -p option to daemon, killproc, and status.
# RHEL < 5 can't.
if status | grep -q -- '-p' 2>/dev/null; then
    daemonopts="--pidfile $pidfile"
    pidopts="-p $pidfile"
fi

if command -v runuser >/dev/null 2>&1; then
    user_wrapper="runuser"
fi

[ "$beat_user" != "root" ] && wrapperopts="$wrapperopts -u $beat_user"

test() {
	$user_wrapper $user_wrapperopts "$agent $args $test_args"
}

start() {
    echo -n $"Starting filebeat: "
	test
	if [ $? -ne 0 ]; then
		echo
		exit 1
	fi
    daemon $daemonopts $wrapper $wrapperopts -- $agent $args
    RETVAL=$?
    echo
    return $RETVAL
}

stop() {
    echo -n $"Stopping filebeat: "
    killproc $pidopts $wrapper
    RETVAL=$?
    echo
    [ $RETVAL = 0 ] && rm -f ${pidfile}
}

restart() {
	test
	if [ $? -ne 0 ]; then
		return 1
	fi
    stop
    start
}

rh_status() {
    status $pidopts $wrapper
    RETVAL=$?
    return $RETVAL
}

rh_status_q() {
    rh_status >/dev/null 2>&1
}

case "$1" in
    start)
        start
    ;;
    stop)
        stop
    ;;
    restart)
        restart
    ;;
    condrestart|try-restart)
        rh_status_q || exit 0
        restart
    ;;
    status)
        rh_status
    ;;
    *)
        echo $"Usage: $0 {start|stop|status|restart|condrestart}"
        exit 1
esac

exit $RETVAL

```