setup.template.enabled: true
setup.ilm.enabled: true
setup.template.name: "out-64-flymoonlog"
setup.template.pattern: "out-64-flymoonlog*"



#主配置文件加载子配置文件
filebeat.config.inputs:
  enabled: true
  path: /etc/filebeat/inputs.d/*.yml
  reload.enabled: true
  reload.period: 10s



# 处理器
# processors:
#   - dissect:
#       when:
#         equals:
#           log_type: out-pord-email_sys-info
#       tokenizer: '%{timestamp} [%{thread}] %{log_level} %{log_message}'
#       field: "message"
#       target_prefix: "parsed_sys_info"
#       ignore_missing: true
#       overwrite_keys: false







#输出
output.elasticsearch:
  hosts: ["http://106.53.194.199:9200"]
  username: "admin"
  password: "123456"
  index: "out-64-flymoonlog-%{[environment]}-%{[application]}-%{+yyyy.MM}"  # 按月分割索引
  bulk_max_size: 50       # 单批次传输最大文档数
  worker: 1                # 并行工作线程数
  timeout: 15s



# 日志记录
logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat.log
  keepfiles: 7
  permissions: 0644



# 设置队列和内存使用
queue.mem:
  events: 1024
  flush.min_events: 512
  flush.timeout: 10s