Question

我已在Windows实例上配置了filebeat 6.6。奇怪的是，即使filebeat可以检测到它，它正在发送IIS的日志，但不发送我指定的文件的日志。

Filebeat.yml

   filebeat.inputs:
- type: log
  enabled: true
  paths:
 - C:\ELK-Logger\filebeat-6.6.1-windows-x86_64\LowError.txt
- type: log
  enabled: true
  paths:
 - C:\inetpub\logs\LogFiles\*\*
 - C:\Hosting\stagingb2c\PaymentGatewayLogs\*\*
  recursive_glob: enabled 
- type: log
  enabled: true
  paths:
 - C:\Hosting\stagingb2c\ErrorLogs\*


filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 3
    output.logstash:
  hosts: ["13.234.83.186:5044"]


processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

logging:
  to_files: true
  files:
path: C:\ELK-Logger\filebeat-6.6.1-windows-x86_64\filebeat-6.6.1-windows-x86_64\LOG
  level: info

我可以从C：\ inetpub \ logs \ LogFiles文件夹中查看日志，但不能从C：\ Hosting \ stagingb2c \ PaymentGatewayLogs中看到日志。

使用：slight_smile启动filebeat.log时，我看不到任何错误或警告：

PS C:\ELK-Logger\filebeat-6.6.1-windows-x86_64\filebeat-6.6.1-windows-x86_64> .\filebeat.exe -e -d "*"

      |2019-03-04T21:15:51.602+0300|INFO|log/harvester.go:255|Harvester started for file: C:\Hosting\stagingb2c\PaymentGatewayLogs\CredimaxPaymentGateway_OrderId_12f1050220190810\CredimaxPayment_TransactionDetails_OrderId_12f1050220190810|
|---|---|---|---|
|2019-03-04T21:15:51.761+0300|INFO|log/harvester.go:255|Harvester started for file: C:\Hosting\stagingb2c\PaymentGatewayLogs\CredimaxPaymentGateway_OrderId_Sw2m\CredimaxPayment_PROCESS_ACS_RESULT_Response_20190213124610_OrderId_Sw2m.txt|
|2019-03-04T21:15:51.920+0300|INFO|log/harvester.go:255|Harvester started for file: C:\Hosting\stagingb2c\PaymentGatewayLogs\CredimaxPaymentGateway_OrderId__SoLx\CredimaxPayment_PAY_Request_20190205085701_OrderId__SoLx.txt|

虽然我肯定可以看到Logstash中有其他文件，但我无法在logstash中看到这些日志。

Answer 1

将输入部分更改为此并检查，

void print_hex(const char *string)
{
        unsigned char *p = (unsigned char *) string;

        for (int i=0; i < strlen(string); ++i) {
                if (! (i % 16) && i)
                        printf("\n");

                printf("0x%02x ", p[i]);
        }
        printf("\n\n");
}

char *umlauts = "1 ä ö ü  Ä Ö Ü  é É  ß € 2";

print_hex(umlauts);

0x31 0x20 0xc3 0xa4 0x20 0xc3 0xb6 0x20 0xc3 0xbc 0x20 0x20 0xc3 0x84
0x20 0xc3 0x96 0x20 0xc3 0x9c 0x20 0x20 0xc3 0xa9 0x20 0xc3 0x89 0x20
0x20 0xc3 0x9f 0x20 0xe2 0x82 0xac 0x20 0x32

Filebeat没有发送特定的日志文件

1 个答案: