[英]Filebeat Is not Sending Logs to Logstash even Harvesting Successfull
我正在嘗試使用 ELK 空間來收集文件日志。 一切正常,直到 filebeat 集成。 我可以通過 tcp 將日志發送到 logstash 並在 kibana 中查看。 但是我無法實現 filebeat 設置來發送日志。 它接縫發送數據但在elasticsearch中看不到。
使用此命令創建elasticsearch。
docker run -d -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" --name elasticsearch docker.elastic.co/elasticsearch/elasticsearch:7.5.2
基巴納:
docker run -d -p 5601:5601 -h kibana --name kibana --link elasticsearch:elasticsearch docker.elastic.co/kibana/kibana:7.5.2
日志存儲:
docker run -d -p 5044:5044 -p 5000:5000 -h logstash --name logstash --link elasticsearch:elasticsearch -vc:/elk2/config-dir:/config-dir docker.elastic.co/logstash/logstash:7.5.2 -f /config-dir/logstash.conf
Logstash.conf 文件
input {
beats {
type => "test"
port => "5044"
}
}
filter {
#If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
if [message] =~ "\tat" {
grok {
match => ["message", "^(\tat)"]
add_tag => ["stacktrace"]
}
}
}
output {
stdout {
codec => rubydebug
}
# Sending properly parsed log events to elasticsearch
elasticsearch {
hosts => ["elasticsearch:9200"]
}
}
在 Windows 10 機器上運行 filebeat。 下載的 zip 和 filebeat.yml 配置
filebeat.modules:
filebeat.inputs:
- type: log
enabled: true
paths:
- C:/elk2/filebeat/log/*.log
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after
output:
logstash:
hosts: ["localhost:5044"]
#Also tried 127.0.0.1/logstash/ip... as hosts here
首先以管理員模式運行powershell
./install-service-filebeat.ps1
然后
./filebeat.exe -c ./filebeat.yml
2020-01-26T22:28:45.652+0300 INFO log/harvester.go:251 Harvester started for file: C:\elk2\filebeat\log\logstash-mehmet.log
2020-01-26T22:29:15.651+0300 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":250,"time":{"ms":250}},"total":{"ticks":343,"time":{"ms":343},"value":343},"user":{"ticks":93,"time":{"ms":93}}},"handles":{"open":664},"info":{"ephemeral_id":"46f26124-44e5-4733-a259-4bed65d07a05","uptime":{"ms":32977}},"memstats":{"gc_next":9518416,"memory_alloc":6349856,"memory_total":10791408,"rss":39120896},"runtime":{"goroutines":28}},"filebeat":{"events":{"added":2,"done":2},"harvester":{"open_files":1,"running":1,"started":1}},"libbeat":{"config":{"module":{"running":0}},"output":{"type":"logstash"},"pipeline":{"clients":1,"events":{"active":0,"filtered":2,"total":2}}},"registrar":{"states":{"current":1,"update":2},"writes":{"success":2,"total":2}},"system":{"cpu":{"cores":8}}}}}
但彈性搜索沒有結果。
嘗試刪除端口中的引號
input {
beats {
type => "test"
port => 5044
}
}
更改logstash.conf中的輸入部分,然后重試,
input {
beats { port => 5044 }
}
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.