Filebeat 未发送特定的日志文件答案

【问题标题】：Filebeat not sending specific Log FilesFilebeat 未发送特定的日志文件
【发布时间】：2019-03-04 19:09:33
【问题描述】：

我在 Windows 实例上配置了 filebeat 6.6。奇怪的是，它正在为 IIS 发送日志，而不是为我指定的文件发送日志，即使 filebeat 可以检测到它。

Filebeat.yml

   filebeat.inputs:
- type: log
  enabled: true
  paths:
 - C:\ELK-Logger\filebeat-6.6.1-windows-x86_64\LowError.txt
- type: log
  enabled: true
  paths:
 - C:\inetpub\logs\LogFiles\*\*
 - C:\Hosting\stagingb2c\PaymentGatewayLogs\*\*
  recursive_glob: enabled 
- type: log
  enabled: true
  paths:
 - C:\Hosting\stagingb2c\ErrorLogs\*


filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 3
    output.logstash:
  hosts: ["13.234.83.186:5044"]


processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

logging:
  to_files: true
  files:
path: C:\ELK-Logger\filebeat-6.6.1-windows-x86_64\filebeat-6.6.1-windows-x86_64\LOG
  level: info

我可以看到来自 C:\inetpub\logs\LogFiles 文件夹的日志，但看不到来自 C:\Hosting\stagingb2c\PaymentGatewayLogs 的日志。

当我使用 :slight_smile: 启动 filebeat.log 时，我在 filebeat.log 中看不到任何错误或警告

PS C:\ELK-Logger\filebeat-6.6.1-windows-x86_64\filebeat-6.6.1-windows-x86_64> .\filebeat.exe -e -d "*"

      |2019-03-04T21:15:51.602+0300|INFO|log/harvester.go:255|Harvester started for file: C:\Hosting\stagingb2c\PaymentGatewayLogs\CredimaxPaymentGateway_OrderId_12f1050220190810\CredimaxPayment_TransactionDetails_OrderId_12f1050220190810|
|---|---|---|---|
|2019-03-04T21:15:51.761+0300|INFO|log/harvester.go:255|Harvester started for file: C:\Hosting\stagingb2c\PaymentGatewayLogs\CredimaxPaymentGateway_OrderId_Sw2m\CredimaxPayment_PROCESS_ACS_RESULT_Response_20190213124610_OrderId_Sw2m.txt|
|2019-03-04T21:15:51.920+0300|INFO|log/harvester.go:255|Harvester started for file: C:\Hosting\stagingb2c\PaymentGatewayLogs\CredimaxPaymentGateway_OrderId__SoLx\CredimaxPayment_PAY_Request_20190205085701_OrderId__SoLx.txt|

我无法在 Logstash 中看到这些日志，但我肯定可以看到 Logstash 中的其他文件。

【问题讨论】：

标签： windows logstash elastic-stack filebeat

【解决方案1】：

将您的输入部分更改为此并检查，

  filebeat.inputs:
- type: log
  enabled: true
  paths:
 - C:\ELK-Logger\filebeat-6.6.1-windows-x86_64\LowError.txt
 - C:\inetpub\logs\LogFiles\*\*
 - C:\Hosting\stagingb2c\PaymentGatewayLogs\*\*
 - C:\Hosting\stagingb2c\ErrorLogs\*
  recursive_glob: enabled

【讨论】：