filebeat设置多行合并之后,kibana日志未合并,请查看附件配置,日志格式和kabana的日志
filebeat.inputs:
- type: log
enabled: true
paths:
- /data/logs/tomcat/platform/default.log
fields:
source: platform
#exclude_lines: ["^$"]
- type: log
enabled: true
paths:
- /data/logs/tomcat/sales/default.log
fields:
source: sales
#exclude_lines: ["^$"]
- type: log
enabled: true
paths:
- /data/logs/tomcat/report/default.log
fields:
source: report
#exclude_lines: ["^$"]
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: true
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after
filebeat.inputs:
- type: log
enabled: true
paths:
- /data/logs/tomcat/platform/default.log
fields:
source: platform
#exclude_lines: ["^$"]
- type: log
enabled: true
paths:
- /data/logs/tomcat/sales/default.log
fields:
source: sales
#exclude_lines: ["^$"]
- type: log
enabled: true
paths:
- /data/logs/tomcat/report/default.log
fields:
source: report
#exclude_lines: ["^$"]
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: true
multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
multiline.negate: true
multiline.match: after
1 个回复
kin122
赞同来自: