需求：Windows dhcp日志需要实时传输到elk或者其他告警平台。
1、filebeat下载地址：https://www.elastic.co/cn/downloads/beats/filebeat
2、下载后解压后配置filebeat.yml文件，
3、README.md文件中有运行的操作方法：cmd上进入filebeat的目录下执行filebeat -c filebeat.yml -e即可运行。
Welcome to Filebeat 8.10.3
Filebeat sends log files to Logstash or directly to Elasticsearch.
Getting Started
To get started with Filebeat, you need to set up Elasticsearch on
your localhost first. After that, start Filebeat with:
./filebeat -c filebeat.yml -e
This will start Filebeat and send the data to your Elasticsearch
instance. To load the dashboards for Filebeat into Kibana, run:
./filebeat setup -e
For further steps visit the
Quick start\](https://www.elastic.co/guide/en/beats/filebeat/8.10/filebeat-installation-configuration.html) guide. ## Documentation Visit \[Elastic.co Docs\](https://www.elastic.co/guide/en/beats/filebeat/8.10/index.html) for the full Filebeat documentation. ## Release notes https://www.elastic.co/guide/en/beats/libbeat/8.10/release-notes-8.10.3.html #备注：遇到gbk的文件，在centos上乱码，可以filebeat转一下 filebeat.inputs: - type: log encoding: GB2312