# Log Collection

The Unified Log Service (ULS) uses the Filebeat component to collect logs and import them into the log service.

## Installation and Startup

### 1. Download Filebeat

Download the [Filebeat](https://www.elastic.co/cn/downloads/past-releases/filebeat-7-10-2) version corresponding to the operating system.

For example, if the installation path is `/usr/local/`: the Filebeat decompression path is `/usr/local/`, after decompression, enter the Filebeat directory `/usr/local/filebeat-${version}`.

### 2. Configure Log Collection

Edit the filebeat.yml configuration file

```
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - #{log_path}

output.kafka:
  hosts: ["kafka1:9092", "kafka2:9092", "kafka3:9092"]
  topic: '#{topic_name}'
```

> Note:
>
> - #{log_path} the directory file for log collection
> - hosts are access addresses
> - #{topic_name} is the log topic

### 3. Start Filebeat

**Example:** Startup command 

```
./filebeat run -c filebeat.yml
```