Filebeat数据备份与恢复实操指南
一 核心原则与备份范围
二 备份操作步骤
手动备份(通用)
sudo cp /etc/filebeat/filebeat.yml /path/to/backup/filebeat.yml.baksudo rsync -a /var/lib/filebeat/ /path/to/backup/filebeat-state/sudo tar czvf /path/to/backup/filebeat-logs-$(date +%F).tar.gz -C /var/log filebeat自动化备份脚本(示例)
#!/usr/bin/env bash
set -e
BACKUP_DIR="/backup/filebeat"
TIMESTAMP=$(date +%F_%H%M%S)
mkdir -p "$BACKUP_DIR"
# 1) 配置
cp -a /etc/filebeat/filebeat.yml "$BACKUP_DIR/filebeat.yml.$TIMESTAMP"
# 2) 状态(注册表,避免重复采集)
rsync -a /var/lib/filebeat/ "$BACKUP_DIR/filebeat-state.$TIMESTAMP/"
# 3) 运行日志
tar czvf "$BACKUP_DIR/filebeat-logs.$TIMESTAMP.tar.gz" -C /var/log filebeat
# 4) 可选:服务状态
systemctl status filebeat > "$BACKUP_DIR/filebeat-status.$TIMESTAMP.txt" 2>&1
echo "Filebeat backup completed at $TIMESTAMP"
sudo chmod +x /usr/local/bin/backup_filebeat.shsudo crontab -e 中添加
0 2 * * * /usr/local/bin/backup_filebeat.shls -lh $BACKUP_DIR 与 tar tzf $BACKUP_DIR/filebeat-logs.*.tar.gz三 恢复步骤
sudo cp /path/to/backup/filebeat.yml.bak /etc/filebeat/filebeat.yml./filebeat -configtest -e(在 Filebeat 安装目录执行或指定 -c /etc/filebeat/filebeat.yml)sudo systemctl stop filebeatsudo rsync -a /path/to/backup/filebeat-state.<时间戳>/ /var/lib/filebeat/sudo systemctl start filebeatsudo tar xzvf /path/to/backup/filebeat-logs-<日期>.tar.gz -C /var/log/sudo systemctl status filebeatjournalctl -u filebeat -n 100 --no-pager四 注意事项与最佳实践