文章内容输出来源：霍格沃兹测试开发学社-测试开发实战训练营
1、filebeat 下载安装
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.15.2-linux-x86_64.tar.gz
tar xzvf filebeat-8.3.3-linux-x86_64.tar.gz
2、es+kibana docker模式运行
docker run -e ES_JAVA_OPTS=“-Xms256m -Xmx256m” -d -p 9200:9200 -p 5601:5601 nshou/elasticsearch-kibana
3、上传jmeter到服务器（filebeat应与jmeter 的日志在一台机器上）
jmeter.log 默认路径： /root/apache-jmeter-5.4.3/bin
4、配置filebeat 日志收集相关配置filebeat.yml（log日志所在路径以及多行匹配相关设置）
多行匹配官方解释：https://www.elastic.co/guide/en/beats/filebeat/7.16/multiline-examples.html
---------------------------------------------
- type: log
# Change to true to enable this input configuration.
enabled: true
# Paths that should be crawled and fetched. Glob based paths.
paths:
#- /var/log/*.log
#- c:\programdata\elasticsearch\logs\*
- /root/apache-jmeter-5.4.3/bin/*.log
include_lines: ['ERROR']
### Multiline options
# Multiline can be used for log messages spanning multiple lines. This is common
# for Java Stack Traces or C-Line Continuation
# The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
#multiline.pattern: ^\[
# Defines if the pattern set under pattern should be negated or not. Default is false.
#multiline.negate: false
# Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
# that was (not) matched before or after or as long as a pattern is not matched based on negate.
# Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
#multiline.match: after
multiline.pattern: ^[0-9]{2}-[0-9]{2}-[0-9]{2}
multiline.negate: true
multiline.match: after
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["192.168.28.100:9200"]
5、启动filebeat
nohup ./filebeat -e -c filebeat.yml &
6、jmeter脚本设置save response file 或者jsr223 监听器。后者配置
if(prev.getResponseCode()!=“200”){
log.error(prev.getResponseDataAsString());
}
#响应码非200 ，log日志打印响应信息
./jmeter -n -t test.jmx
7、访问es的kibana http://ip:5601 kibana->Index patterns filebeat*(前提是filebeat采集已生成数据)
Management->Dev Tools : GET _cat/indices?v 可查看到已生成filebeat 开头的索引：
filebeat-7.5.1-2022.08.24-000001
注：ES7以后，默认是开启了ILM的，而这种开启了ILM策略的输出默认是以filebeat开头，日期结尾，00001开始的索引结束
如果不想要这种格式的索引,如：nginx-2022.08.24
vi filebeat.yml
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["localhost:9200"]
index: "nginx-%{+yyyy.MM.dd}"
setup.template.name: "default@template"
setup.template.pattern: "nginx-*"
setup.ilm.enabled: false
修改yml文件后，重新启动filebeat 和es ,执行jmeter 可确认上述效果。
推荐阅读：https://blog.csdn.net/Hogwartstester/article/details/103391610**粗体文本**