Мой filebeat.yml выглядит следующим образом >
Код: Выделить всё
filebeat.inputs:
- type: filestream
paths:
- /myfile/logs/json/*.json
json.keys_under_root: true
json.overwrite_keys: true
json.add_error_key: true
parsers:
- ndjson:
target: ""
message_key: message
- type: filestream
paths:
- /myfile/logs/another-log.log*
fields:
application: my-app
scan_frequency: 10s
multiline.type: pattern
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after
include_lines:
- error
- ERROR
- FATAL
- INFO
- WARN
- DEBUG
- debug
enabled: true
processors:
- add_locale:
format: offset
setup.template:
name: "blabla-%{[agent.version]}"
pattern: "bla-bla-%{[agent.version]}*"
json:
enabled: true
path: "${path.config}/templates/blabla-7.16.3-template.json"
name: "blabla-7.16.3"
setup.ilm:
enabled: false
# ============================== Elasticsearch Output ===============================
output.elasticsearch:
# Array of hosts to connect to.
hosts: [ "firstHost:port", "secondHost:port" ]
index: "my-index-%{[agent.version]}-%{+yyyy-ww}"
bulk_max_size: 1024
# ============================== Filebeat Logging ==============================
logging.level: info
logging.to_files: true
logging.files:
rotateeverybytes: 10485760
path: /appbase/filebeat/logs
name: filebeat.log
keepfiles: 7
permissions: 436
registry_file: /myfile/filebeat/data/registry
# ============================== General Settings ==============================
shipper: null
Код: Выделить всё
Aug 02 16:36:26 myServer: filebeat.service: Scheduled restart job, restart counter is at 5.
Aug 02 16:36:26 myServer: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
Aug 02 16:36:26 myServer: filebeat.service: Start request repeated too quickly.
Aug 02 16:36:26 myServer: filebeat.service: Failed with result 'core-dump'.
Aug 02 16:36:26 myServer: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..
Я подождал пару часов, но так и не смог его запустить.
Я также проверил filebeat.service, все без изменений и правильно.
У вас есть идеи? ?
Подробнее здесь: https://stackoverflow.com/questions/788 ... -result-co