超烂的ELK之filebeat读取【已解决】

 

搞了无数次的filebeat-->logstash今天栽了跟头

 

filebeat在读取如下文件的时候，openchgw.log 软连接speechgw.log.20170703183729文件

lrwxrwxrwx 1 admin admin        44 Jul  3 18:37 speechgw.log -> /home/admin/logs/speechgw.log.20170703183729

如果filebeat中配置

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- input_type: log
  paths:
    - /home/admin/logs/speechgw.log
  document_type: open-gw

则不会收取日志，必须配置如下成实体文件，才能够成功。

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- input_type: log
  paths:
    - /home/admin/logs/speechgw.log.20170703183729

 document_type: open-gw

 

 

感觉ELK是不是应该修复一下这个问题。

 

在filebeat.full.yml中开启参数

symlinks: true

解决问题。多谢zolinxu @zolinxu 2018-02-28的指教。

 

谢谢！