https://elasticsearch.cn/question/3409 在这个问题中找到了同样的困境,但是并没有从文章中得到解决方案。。
首先我是filebeat->logstash->es 这样的流程架构,fb是和logstash都是6.3的。
filebeat配置如下:
然后看logstash,我是是这么处理的:
结果索引名变成了:mylog-%{fields}%{cluster}2018.08.07 很明显这俩变量没生效,并没有变成mylog-orderlog20180807这样的格式, 换成了
[fields][cluster] 一样没用 和上面的名字一样。不懂为何不生效,求解
首先我是filebeat->logstash->es 这样的流程架构,fb是和logstash都是6.3的。
filebeat配置如下:
#=========================== Filebeat inputs =============================
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
- type: log
# Change to true to enable this input configuration.
enabled: true
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /opt/flogs/*.log
- /opt/log/orderlog/*.log
#- c:\programdata\elasticsearch\logs\*
fields:
cluster: orderlog
# Exclude lines. A list of regular expressions to match. It drops the lines that are
# matching any regular expression from the list.
#exclude_lines: ['^DBG']
# Include lines. A list of regular expressions to match. It exports the lines that are
# matching any regular expression from the list.
#include_lines: ['^ERR', '^WARN']
# Exclude files. A list of regular expressions to match. Filebeat drops the files that
# are matching any regular expression from the list. By default, no files are dropped.
#exclude_files: ['.gz$']
# Optional additional fields. These fields can be freely picked
# to add additional information to the crawled log files for filtering
#fields:
# level: debug
# review: 1
### Multiline options
# Mutiline can be used for log messages spanning multiple lines. This is common
# for Java Stack Traces or C-Line Continuation
# The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
#multiline.pattern: ^\[
# Defines if the pattern set under pattern should be negated or not. Default is false.
#multiline.negate: false
# Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
# that was (not) matched before or after or as long as a pattern is not matched based on negate.
# Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
#multilinie.match: after
multiline.pattern: '^\['
multiline.negate: true
multiline.match: after
截取inputs这部分。我已经配置了fileds,设置了k-v然后看logstash,我是是这么处理的:
input {
beats {
port => 5044
}
}
output {
elasticsearch {
hosts => "http://xxxxx:xx"
manage_template => true
index => "mylog-%{fields}%{cluster}%{+YYYY.MM.dd}"
template_name => "tmp_mylog"
}
}
结果索引名变成了:mylog-%{fields}%{cluster}2018.08.07 很明显这俩变量没生效,并没有变成mylog-orderlog20180807这样的格式, 换成了
[fields][cluster] 一样没用 和上面的名字一样。不懂为何不生效,求解
1 个回复
spoofer
赞同来自:
而且, 你的output配置少了个 “"” ?