Logstash每次如何从末尾读取日志?

时间:2018-01-11 07:14:17

标签: logstash

以下是我从logstash输入的conf:

input {
file {
    path => "/usr/local/elk/mos-log/mt.log"
    type => "mos-mt-log"
    codec => multiline {
      pattern => "^\["
      negate => true
      what => "next"
      }
    start_position => "end"
}
file {
    path => "/usr/local/elk/mos-log/rpt.log"
    type => "mos-rpt-log"
    codec => multiline {
      pattern => "^\["
      negate => true
      what => "next"
    }
  start_position => "end"
}}

每当我手动将日志添加到日志中时,Logstash始终会从头到尾读取日志。你如何确保Logstash从最后读取日志? 字段start_position => conf中的“end”不起作用

0 个答案:

没有答案