啟動階段：
instance/beat.go #打印home路徑、配置路徑、數據路徑和日志路徑
seccomp #Syscall filter檢查
instance/beat.go #beat info
instance/beat.go #build info
instance/beat.go #Go runtime info
instance/beat.go #Host info
instance/beat.go #Process info
instance/beat.go #Setup Beat info
pipeline/consumer.go #開始pipeline event consumer
pipeline/module.go
log/log #每30s開始metrics
instance/beat.go #filebeat開始運行
registrar/registrar.go 加載registrar數據
crawler/crawler.go #加載輸入
log/input.go:138 #配置路徑
input/input.go:114 #開始input類型
crawler/crawler.go:106 加載並開始輸入
cfgfile/reload.go:150 配置重載開始
log/harvester.go:254 開始對目標文件進行收割
pipeline/processor.go:308 Publish event:{
"@timestamp": "2019-02-15T08:11:11.705Z",
"@metadata": {
"beat": "filebeat",
"type": "doc",
"version": "6.5.4"
},
"beat": {
"name": "host-10-191-51-5",
"hostname": "host-10-191-51-5",
"version": "6.5.4"
},
"host": {
"name": "host-10-191-51-5"
},
"source": "/root/testlog/test1.log",
"offset": 0,
"message": "{1}{one}",
"prospector": {
"type": "log"
},
"input": {
"type": "log"
},
"apache": true
}
。。。。。。。。。。。。。。。。。。。。。。。
與kafka連接階段：
pipeline/output.go:95 Connecting to kafka(10.193.1.127:19092)
kafka/log.go:53 kafka message: Initializing new client
kafka/log.go:53 client/metadata fetching metadata for all topics from broker 10.193.1.127:19092
kafka/log.go:53 Connected to broker at 10.193.1.127:19092 (unregistered)
kafka/log.go:53 client/brokers registered new broker #2 at 10.193.1.138:19092
kafka/log.go:53 client/brokers registered new broker #1 at 10.193.1.127:19092
kafka/log.go:53 client/brokers registered new broker #3 at 10.193.1.153:19092
kafka/log.go:53 kafka message: Successfully initialized new client
pipeline/output.go:105 Connection to kafka(10.193.1.127:19092) established
kafka/log.go:53 producer/broker/2 starting up
kafka/log.go:53 producer/broker/2 state change to [open] on dbank-zuul002/0
kafka/log.go:53 Connected to broker at 10.193.1.138:19092 (registered as #2)
。。。。。。。。。。。。。。。。。。。。。。。
關閉階段：
beater/filebeat.go:449 Stopping filebeat
crawler/crawler.go:139 Stopping Crawler
cfgfile/reload.go:208 Dynamic config reloader stopped
input/input.go:149 input ticker stopped
log/harvester.go:275 Reader was closed: /root/testlog/test1.log. Closing.
[publish] pipeline/client.go:148 client: closing acker
[publish] pipeline/client.go:150 client: done closing acker
[publish] pipeline/client.go:154 client: cancelled 0 events
crawler/crawler.go:165 Crawler stopped
registrar/registrar.go:356 Stopping Registrar
registrar/registrar.go:282 Ending Registrar
[monitoring] log/log.go:152 Total non-zero metrics
instance/beat.go:410 filebeat stopped.