将下载的日志文件重播到ELK服务器中

Question

Our deployed systems collect "regular" plain old log4j log files. Since it is a distributed system, there are 5-10 of these. When there is a problem it is possible to obtain the log files as a zip file.

I found this docker ELK image which works great. However, this is new to me, and all the examples talk about using something such as filebeat to play the log information to ElasticSearch. I am wondering if there exists a way to essentially "replay" an existing set of log files into such an ELK container instance? Or is this something I would need to build?

Answer 1

I am not sure why you don't want to use filebeat as it handles network outage gracefully and guarantees log delivery. I would use filebeat even if it is just a local installation (same domain where ELK is) and i would just feed the collected logs to it from your system (with rsync or manually) if you don't want to install filebeat on every log source server to send to your main logstash instance.

On the other hand there is a very basic logstash file input plugin which you can use for direct reading: https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html