要不要再翻翻文档呢?

filebeat报大量错误Error decoding JSON

Beats | 作者 b8_yang@163.com | 发布于2018年07月13日 | 阅读数:8868

{"log":"2018-07-13T21:42:23.902+0800\u0009ERROR\u0009reader/json.go:33\u0009Error decoding JSON: json: cannot unmarshal number into Go value of type map[string]interface {}\n","stream":"stderr","time":"2018-07-13T13:42:23.90710824Z"}
 
配置如下图
filebeat.prospectors:
#filebeat.inputs:
- type: docker
  containers:
    path: "/var/lib/docker/containers/"
    ids:
        - '*'
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: log
  fields: 
    logtype: docker 
#  fields_under_root: true
# Autodiscover docker containers and parse logs
  providers:
    - type: docker
  processors:
    - add_docker_metadata: ~
  # include_lines: ['^ERR', '^WARN']
  multiline.pattern: '^\{"log":'
  multiline.negate: true
  multiline.match: after
  logging.level: error
  logging.to_files: true
  logging.files:
     path: /root/filebeat-6.3.1-linux-x86_64/logs
     name: filebeat
     keepfiles: 7
     permissions: 0644
- type: log
  paths:
    - /var/log/messages
  enabled: true
#add fields differd logtype index
  fields: 
    logtype: messages
#  fields_under_root: true
output.redis:
    hosts: ["192.168.1.104:6379"]
    key: "docker-a"
    db: 0
    timeout: 5
#output.elasticsearch:
#   hosts: ["localhost:9200"]
#    protocol: "https"
#   username: "elastic"
#   password: "changeme"
#   index: "filebeat-%{[beat.version]}-%{+yyyy.MM.dd}"
shipper:
logging:
   files:
      rotateeverybytes: 10485760
 
已邀请:

sunhackboy

赞同来自:

你好,这个问题解决了吗

要回复问题请先登录注册