有个人长的像洋葱,走着走着就哭了…….

filebeat 配置fields字段,logstash接收不到

Logstash | 作者 code4j | 发布于2018年08月07日 | 阅读数:5800

https://elasticsearch.cn/question/3409   在这个问题中找到了同样的困境,但是并没有从文章中得到解决方案。。
 
首先我是filebeat->logstash->es 这样的流程架构,fb是和logstash都是6.3的。
 
filebeat配置如下:
#=========================== Filebeat inputs =============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

# Change to true to enable this input configuration.
enabled: true

# Paths that should be crawled and fetched. Glob based paths.
paths:
- /opt/flogs/*.log
- /opt/log/orderlog/*.log
#- c:\programdata\elasticsearch\logs\*
fields:
cluster: orderlog

# Exclude lines. A list of regular expressions to match. It drops the lines that are
# matching any regular expression from the list.
#exclude_lines: ['^DBG']

# Include lines. A list of regular expressions to match. It exports the lines that are
# matching any regular expression from the list.
#include_lines: ['^ERR', '^WARN']

# Exclude files. A list of regular expressions to match. Filebeat drops the files that
# are matching any regular expression from the list. By default, no files are dropped.
#exclude_files: ['.gz$']

# Optional additional fields. These fields can be freely picked
# to add additional information to the crawled log files for filtering
#fields:
# level: debug
# review: 1

### Multiline options

# Mutiline can be used for log messages spanning multiple lines. This is common
# for Java Stack Traces or C-Line Continuation

# The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
#multiline.pattern: ^\[

# Defines if the pattern set under pattern should be negated or not. Default is false.
#multiline.negate: false

# Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
# that was (not) matched before or after or as long as a pattern is not matched based on negate.
# Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
#multilinie.match: after
multiline.pattern: '^\['

multiline.negate: true

multiline.match: after


截取inputs这部分。我已经配置了fileds,设置了k-v
 
然后看logstash,我是是这么处理的:
input {
beats {
port => 5044
}
}

output {
elasticsearch {
hosts => "http://xxxxx:xx"
manage_template => true
index => "mylog-%{fields}%{cluster}%{+YYYY.MM.dd}"
template_name => "tmp_mylog"
}
}



结果索引名变成了:mylog-%{fields}%{cluster}2018.08.07  很明显这俩变量没生效,并没有变成mylog-orderlog20180807这样的格式, 换成了
[fields][cluster] 一样没用 和上面的名字一样。不懂为何不生效,求解
已邀请:

spoofer

赞同来自:

index => "mylog-%{[fields][cluster]}%{+YYYY.MM.dd}" 试一下
 
而且, 你的output配置少了个 “"” ?
 

要回复问题请先登录注册