版本:6.1.3
问题:一个配置里,不同的log,输入到不同的index
启动可以成功,DEBUG日志显示收集了日志,也不报错。但数据没有入index。
改为一个index就可以。二个就不入库了。
详细配置如下(缩进问题,仔细核对过的):
filebeat.prospectors:
- type: log
enabled: true
paths:
- /var/log/mndn01.log
fields:
"index": "my_index01"
- type: log
enabled: true
paths:
- /var/log/mndn02.log
fields:
"index": "my_index02"
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 3
output.elasticsearch:
hosts: ['***************************************']
index: "my_index*"
indices:
- index: "my_index01"
when.equals:
fields.index: "my_index01"
- index: "my_index02"
when.equals:
fields.index: "my_index02"
setup.template.name: "my_index"
setup.template.pattern: "my_index*"
问题:一个配置里,不同的log,输入到不同的index
启动可以成功,DEBUG日志显示收集了日志,也不报错。但数据没有入index。
改为一个index就可以。二个就不入库了。
详细配置如下(缩进问题,仔细核对过的):
filebeat.prospectors:
- type: log
enabled: true
paths:
- /var/log/mndn01.log
fields:
"index": "my_index01"
- type: log
enabled: true
paths:
- /var/log/mndn02.log
fields:
"index": "my_index02"
filebeat.config.modules:
path: ${path.config}/modules.d/*.yml
reload.enabled: false
setup.template.settings:
index.number_of_shards: 3
output.elasticsearch:
hosts: ['***************************************']
index: "my_index*"
indices:
- index: "my_index01"
when.equals:
fields.index: "my_index01"
- index: "my_index02"
when.equals:
fields.index: "my_index02"
setup.template.name: "my_index"
setup.template.pattern: "my_index*"
1 个回复
bellengao - 博客: https://www.jianshu.com/u/e0088e3e2127
赞同来自: