关于 filebeat 多个output 问题

作者 yushun | 发布于2017年12月07日 | 阅读数:3265

大家好 我之前 使用filebeat 5.22的时候 
我的filebeat.yml 内容如下
filebeat.prospectors:
- input_type: log
  tail_files: True
  paths: /opt/log/XXXX/*monitor.log
  document_type: ec_XXXXX_monitor
 
output.kafka:
。。。。
output.logstash:
 
。。。。
 
配置了 2个outoutput,将我的日志同时发到两个地方去,在5.22版本下工作的很顺利
我换成 filebeat6.0 后,程序提示 output里包含多个namespace 无法工作。
请问大家有没有好的方案 用filebeat6.0 将日志发两份到不同的地方去呢
已邀请:

yushun

赞同来自:

在官网查了下 filebeat 6.x以后  只允许一个output了
 
Only one enabled outputedit

In versions prior to 6.0, you could enabled multiple outputs at the same time, but only of different types. For example, you were able to enable the Elasticsearch and Logstash outputs, but not two Logstash outputs. The drawback of enabling multiple outputs was that the Beats that wait for acknowledgments (Filebeat and Winlogbeat) before proceeding slowed down to the slowest output. This implication was not obvious and hindered the use cases where multiple outputs would have been useful.

As part of the pipeline re-architecture that we did for 6.0, we removed the option to enable multiple outputs at the same time. This helps with keeping the pipeline simple and with clarifying the scope of outputs in Beats.

If you require multiple outputs, you have the following options:

use the Logstash output and then use Logstash to pipe the events to multiple outputs
run multiple instances of the same Beat

If you used the file or console outputs for debugging purposes, in addition to the main output, we recommend using the -d "publish" option which logs the published events in the Filebeat logs.

要回复问题请先登录注册