2020-05-07
filebeat7.6.1修改索引名字后，比如下面這樣，shop-api xxx
|
1
2
3
4
5
|
output.elasticsearch:
hosts: ["http://192.168.0.10:9200"]
index: "shop-api-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "shop-api"
setup.template.pattern: "shop-api-*"
|
啟動后，發現在es中並沒有生成新的索引。
filebeat有打印下面的日志信息
|
1
2
3
4
|
2020-05-07T02:40:53.010Z INFO [index-management] idxmgmt/std.go:258 Auto ILM enable success.
2020-05-07T02:40:53.012Z INFO [index-management.ilm] ilm/std.go:139 do not generate ilm policy: exists=true, overwrite=false
2020-05-07T02:40:53.012Z INFO [index-management] idxmgmt/std.go:271 ILM policy successfully loaded.
2020-05-07T02:40:53.012Z INFO [index-management] idxmgmt/std.go:410 Set setup.template.name to '{filebeat-7.6.1 {now/d}-000001}' as ILM is enabled.
|
提示開啟了ILM策略
翻官方文檔（https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html）后發現：
index配置部分中提示 The index setting is ignored when index lifecycle management is enabled
意思就是index設置的參數在索引生命周期管理（ilm）開啟后會忽略。
查看ilm文檔 https://www.elastic.co/guide/en/beats/filebeat/current/ilm.html 提示：
Starting with version 7.0, Filebeat uses index lifecycle management by default when it connects to a cluster that supports lifecycle management
從7.0版本開始，當elasticsearch支持生命周期管理時，filebeat默認使用索引生命周期管理，這樣就導致自己修改的日志文件名無效了。
關閉ilm功能即可(setup.ilm.enabled: false)。
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
[root@node1 shop-api]# cat filebeat.yml
filebeat.inputs:
- type: log
paths:
- /mnt/logs/*.log
fields:
java: true
fields_under_root: true
multiline.pattern: '^[0-9]{2}:[0-9]{2}:[0-9]{2}.* \[http-nio'
multiline.negate: true
multiline.match: after
setup.ilm.enabled: false
output.elasticsearch:
hosts: ["http://192.168.0.10:9200"]
index: "shop-api-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "shop-api"
setup.template.pattern: "shop-api-*"
|
原創文章，轉載請注明。本文鏈接地址: https://www.rootop.org/pages/4770.html