filebeat 7.5.2(2)

Question

filebeat.inputs:

• type: log
  enabled: true
  paths:
  • /var/log/sys_total.log
    exclude_lines: [‘qemu-ga’,‘filebeat’]

logging.level: info
logging.to_files: true
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 0644

output.elasticsearch:
hosts: [“http://192.168.167.234:9200”,“http://192.168.167.175:9200”,“http://192.168.167.204:9200”]
index: “system-%{+YYYY.MM.dd}”

setup.ilm.enabled: false
setup.template.name: system
setup.template.pattern: system-*

这样改还是不行 日志输入到的还是/var/log/messages

Answer 1

rockybean 2020-02-18 17:47:42

参见这里

https://github.com/elastic/beats/issues/11855

从 7 版本开始默认都往 stderr 输出了，你可以改下 systemd 的配置

mkdir -p /etc/systemd/system/filebeat.service.d
cat > /etc/systemd/system/filebeat.service.d/disable_stderr_logging.conf <<'EOT'
[Service]
Environment="BEAT_LOG_OPTS="
EOT
systemctl daemon-reload
systemctl restart filebeat

• 提问者 苦瓜苦也 #1

  非常感谢！