文件汇总后Logstash 7.0.0停止收集日志

时间:2019-04-19 10:47:56

标签: logstash logstash-file

将logstash升级到7.0.0后,它将在午夜后滚动文件时停止收集日志。升级之前,一切正常。要强制它提取新文件,我需要重新启动它。

由于我使用了尾部模式,因此它应该可以工作(文档显示:When files are rotated, the smaller or zero size is detected, the current position is reset to zero and streaming continues.),但实际上并没有。

这是我的配置

input {
    file {
        codec => multiline {
            charset => "UTF-8"
            pattern => "^%{TIMESTAMP_ISO8601} "
            max_lines => 2000
            negate => true
            what => previous
        }
        path => "[path].log"
        start_position => beginning
        sincedb_path => "NUL"
    }
}

filter {
    grok {
        match => {"path" => "%{GREEDYDATA}/%{GREEDYDATA:application}"}
    }
    grok {
        match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} \[%{DATA:thread}\] (?<level>.....) %{DATA:logger} - %{GREEDYDATA:message}" }
        overwrite => [ "message" ]
    }
    date {
        match => [ "timestamp", "YYYY-MM-dd HH:mm:ss,SSS"]
        target => "@timestamp"
    }
}

output {
    elasticsearch {
        hosts => [ "[host]" ]
        user => "[user]"
        password => "[somepass]"
    }
    stdout { 
        codec => rubydebug
    }
}

有什么线索可以解决这个问题吗?

0 个答案:

没有答案