Question

我正在centos服务器上使用文件版本5.6.16将日志从路径/opt/news-bff/logs/Icis.Genesis*.log推送到logstash

匹配的日志文件很多

-rw-r--r--. 1 root root  5049 Sep 25 10:30 Icis.Genesis.News.Bff.Api-2019092510.log
-rw-r--r--. 1 root root  1551 Sep 25 12:15 Icis.Genesis.News.Bff.Api-2019092512.log
-rw-r--r--. 1 root root  2650 Sep 25 13:55 Icis.Genesis.News.Bff.Api-2019092513.log
-rw-r--r--. 1 root root 39447 Sep 25 14:50 Icis.Genesis.News.Bff.Api-2019092514.log
-rw-r--r--. 1 root root  6191 Sep 25 15:31 Icis.Genesis.News.Bff.Api-2019092515.log

但是问题是，filebeat将打开每个文件的收割机，五分钟后将其标记为不活动，并且不发送任何日志。 /var/lib/filebeat/registry文件为空。

我预配置了多个centos服务器，并使用p在其上安装了文件节拍。 10次中的5次，filebeat挑选没有任何问题的日志文件。否则我会遇到这个问题。

如果删除注册表文件并重新发送服务，它将正常工作。

文件拍探矿器如下所示：

filebeat:
  prospectors:
    - input_type: log
      paths:
        - /opt/news-bff/logs/Icis.Genesis*.log
      encoding: plain
      fields_under_root: false
      document_type: log
      scan_frequency: 10s
      harvester_buffer_size: 16384
      max_bytes: 10485760`

logs:
2019-09-25T12:16:01+01:00 INFO Harvester started for file: /opt/news-bff/logs/Icis.Genesis.News.Bff.Api-2019092512.log
2019-09-25T12:16:10+01:00 INFO Non-zero metrics in the last 30s: filebeat.harvester.open_files=1 filebeat.harvester.running=1 filebeat.harvester.started=1 libbeat.logstash.publish.read_bytes=36
2019-09-25T12:16:40+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read_bytes=36
2019-09-25T12:17:10+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read_bytes=36
2019-09-25T12:17:40+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read_bytes=36
2019-09-25T12:18:10+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read_bytes=36
2019-09-25T12:18:40+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read_bytes=36
2019-09-25T12:19:10+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read_bytes=36
2019-09-25T12:19:40+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read_bytes=30
2019-09-25T12:20:10+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read_bytes=36
2019-09-25T12:20:40+01:00 INFO Non-zero metrics in the last 30s: libbeat.logstash.publish.read_bytes=36
2019-09-25T12:21:06+01:00 INFO File is inactive: /opt/news-bff/logs/Icis.Genesis.News.Bff.Api-2019092512.log. Closing because close_inactive of 5m0s reached.

即使日志文件中有未读内容，filebeat也会将日志文件标记为不活动

0 个答案: