Question

在Filebeat中，我导入json文件和txt文件。我有以下日志文件：

2018-12-20T10:41:36.977+0100    ERROR   json/json.go:51 Error decoding JSON: json: cannot unmarshal number into Go value of type map[string]interface {}
2018-12-20T10:41:36.977+0100    DEBUG   [publish]   pipeline/processor.go:308   Publish event: {
  "@timestamp": "2018-12-20T09:41:36.977Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "doc",
    "version": "6.5.3"
  },
  "source": "/opt/tomcat-bo/logs/localhost_access_log.2018-12-20.txt",
  "offset": 569215,
  "input": {
    "type": "log"
  },
  "prospector": {
    "type": "log"
  },
  "beat": {
    "name": "x",
    "hostname": "x",
    "version": "6.5.3"
  },
  "host": {
    "name": "x",
    "containerized": true,
    "architecture": "x86_64",
    "os": {
      "platform": "centos",
      "version": "7 (Core)",
      "family": "redhat",
      "codename": "Core"
    },
    "id": "someIdHere"
  },
  "json": {},
  "message": "127.0.0.1 - - [20/Dec/2018:10:41:32 +0100] \"POST /b/getTime HTTP/1.1\" 200 36 \"tt: 13 ms\""
}

我的Filebeat配置是：

filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /opt/tomcat-gw/logs/*.json
    - /opt/tomcat-bo/logs/*.json
    - /opt/tomcat-gw/logs/localhost_access_log*.txt
    - /opt/tomcat-bo/logs/localhost_access_log*.txt
  json:
    message_key: event
    keys_under_root: true

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 3
setup.kibana:
  host: "someIp:5602"
output.logstash:
  hosts: ["someIp:5044"]

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

我认为问题在于它加载了txt文件而不是json文件，并试图将其解析为json-我该怎么做才能避免出现此问题一个filebeat实例？

Filebeat无法解组号码

0 个答案: