超爛的ELK之filebeat讀取【已解決】

 

搞了無數次的filebeat-->logstash今天栽了跟頭

 

filebeat在讀取如下文件的時候，openchgw.log 軟連接speechgw.log.20170703183729文件

lrwxrwxrwx 1 admin admin        44 Jul  3 18:37 speechgw.log -> /home/admin/logs/speechgw.log.20170703183729

如果filebeat中配置

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- input_type: log
  paths:
    - /home/admin/logs/speechgw.log
  document_type: open-gw

則不會收取日志，必須配置如下成實體文件，才能夠成功。

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- input_type: log
  paths:
    - /home/admin/logs/speechgw.log.20170703183729

 document_type: open-gw

 

 

感覺ELK是不是應該修復一下這個問題。

 

在filebeat.full.yml中開啟參數

symlinks: true

解決問題。多謝zolinxu @zolinxu 2018-02-28的指教。

 

謝謝！