超烂的ELK之filebeat读取【已解决】

最新推荐文章于 2024-07-13 11:10:40 发布

weixin_30700099

最新推荐文章于 2024-07-13 11:10:40 发布

阅读量163

点赞数

CC 4.0 BY-SA版权

原文链接：http://www.cnblogs.com/zhzhang/p/7118694.html

本文探讨了Filebeat在读取软链接文件时遇到的问题及解决办法。通过配置filebeat.full.yml中的symlinks参数为true，使得Filebeat能够正确处理软链接文件，将日志数据顺利发送到Logstash。

搞了无数次的filebeat-->logstash今天栽了跟头

filebeat在读取如下文件的时候，openchgw.log 软连接speechgw.log.20170703183729文件

lrwxrwxrwx 1 admin admin        44 Jul  3 18:37 speechgw.log -> /home/admin/logs/speechgw.log.20170703183729

如果filebeat中配置

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- input_type: log
  paths:
    - /home/admin/logs/speechgw.log
  document_type: open-gw

则不会收取日志，必须配置如下成实体文件，才能够成功。

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- input_type: log
  paths:
    - /home/admin/logs/speechgw.log.20170703183729