Elasticsearch + Filebeat + Logstash

Question

我是弹性堆栈的新手，最近尝试将日志发送到 ELK 堆栈，但观察到奇怪的问题。 有人可以建议我配置。

filebeat.yml
filebeat.inputs:
- type: log
  paths:
    #- /var/log/*.log
    - D:\apps\logs\RGGYSLT-0473\learnings-elasticsearch\*.log
  multiline.pattern: '^\[[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

logstash.conf
input {
    beats {
        type => "v1-elasticsearch"
        host => "127.0.0.1"
        port => "5044"
    }
}

filter {

  if[type] == "v1-elasticsearch" {  
      #If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
      if [message] =~ "\tat" {
        grok {
          match => ["message", "^(\tat)"]
          add_tag => ["stacktrace"]
        }
      }  
  }  
}

output {   
  stdout {
    codec => rubydebug
  }

  # Sending properly parsed log events to elasticsearch
  elasticsearch {
     hosts => ["http://localhost:9200"]
     index => "dhisco-learnings-elasticseach-%{+YYYY.MM.dd}"
     document_type => "%{[@metadata][type]}"
    #user => "elastic"
    #password => "changeme"
  }
}

Kibana output -

Jun 7, 2020 @ 23:58:58.067  2020-06-07 23:58:48,480 88900 [http-nio-9090-exec-2] INFO  c.d.l.e.web.HotelController - Brand: RADISSON
2020-06-07 23:58:49,297 88900 [http-nio-9090-exec-3] INFO  c.d.l.e.web.HotelController - Brand: RADISSON

我打了我的 controller 两次，但不幸的是，两个日志都连接起来并显示在相同的时间戳上。

有人可以建议吗？

Answer 1

我使用 json 编码器做了同样的事情，从未遇到任何问题。