Question

我正在玩filebeat（6.4 + 6.5），因为Docker监视同一主机上的其他Docker容器。

它与autodiscovery功能配合得很好，我的filebeat.yml看起来像这样：

filebeat.autodiscover:
  providers:
    - type: docker
      templates:
        - condition:
            has_fields:
              - docker.container.labels.com.foobar.logs.type
          config:
            - type: docker
              containers:
                ids:
                  - "${data.docker.container.id}"
                stream: all
              paths:
                - /var/lib/docker/containers/${data.docker.container.id}/*.log
              fields:
                log_type: "${docker.container.labels.com.foobar.logs.type}"
                foo: bar

processors:
  - add_cloud_metadata: ~
  - add_docker_metadata: ~

output.redis:
  hosts: ["${REDIS_HOST}"]
  key: "filebeat"
  db: 0
  timeout: 10

但是，每次x运行都会改变redis的行为，有时filebeat将对消息字段进行json解码：

logstash_1_f7e7e988a4af |       "@version" => "1",
logstash_1_f7e7e988a4af |         "offset" => 0,
logstash_1_f7e7e988a4af |         "stream" => "stdout",
logstash_1_f7e7e988a4af |           "host" => {
logstash_1_f7e7e988a4af |         "name" => "f3135fa546a2"
logstash_1_f7e7e988a4af |     },
logstash_1_f7e7e988a4af |         "source" => "/var/lib/docker/containers/c5b44c22a654d4622af2ad0df971d3eee35db318cccaf88ea9fb1a877882c108/c5b44c22a654d4622af2ad0df971d3eee35db318cccaf88ea9fb1a877882c108-json.log",
logstash_1_f7e7e988a4af |        "message" => "172.26.0.1 - - [22/Nov/2018:10:16:04 +0000] \"GET / HTTP/1.1\" 200 612 \"-\" \"curl/7.47.0\" \"-\""
logstash_1_f7e7e988a4af | }

有时候不会：

logstash_1_7c18eb226755 |        "message" => "{\"log\":\"192.168.80.1 - - [22/Nov/2018:10:38:46 +0000]  \\\"GET / HTTP/1.1\\\" 200 612 \\\"-\\\" \\\"curl/7.47.0\\\" \\\"localhost:8181\\\"\\n\",\"stream\":\"stdout\",\"time\":\"2018-11-22T10:38:46.945703331Z\"}",

通过自动发现filebeat docker输入不一致的消息行为

0 个答案: