{"log":"2018-07-13T21:42:23.902+0800\u0009ERROR\u0009reader/json.go:33\u0009Error decoding JSON: json: cannot unmarshal number into Go value of type map[string]interface {}\n","stream":"stderr","time":"2018-07-13T13:42:23.90710824Z"}
配置如下图
filebeat.prospectors:
#filebeat.inputs:
- type: docker
containers:
path: "/var/lib/docker/containers/"
ids:
- '*'
json.keys_under_root: true
json.add_error_key: true
json.message_key: log
fields:
logtype: docker
# fields_under_root: true
# Autodiscover docker containers and parse logs
providers:
- type: docker
processors:
- add_docker_metadata: ~
# include_lines: ['^ERR', '^WARN']
multiline.pattern: '^\{"log":'
multiline.negate: true
multiline.match: after
logging.level: error
logging.to_files: true
logging.files:
path: /root/filebeat-6.3.1-linux-x86_64/logs
name: filebeat
keepfiles: 7
permissions: 0644
- type: log
paths:
- /var/log/messages
enabled: true
#add fields differd logtype index
fields:
logtype: messages
# fields_under_root: true
output.redis:
hosts: ["192.168.1.104:6379"]
key: "docker-a"
db: 0
timeout: 5
#output.elasticsearch:
# hosts: ["localhost:9200"]
# protocol: "https"
# username: "elastic"
# password: "changeme"
# index: "filebeat-%{[beat.version]}-%{+yyyy.MM.dd}"
shipper:
logging:
files:
rotateeverybytes: 10485760
配置如下图
filebeat.prospectors:
#filebeat.inputs:
- type: docker
containers:
path: "/var/lib/docker/containers/"
ids:
- '*'
json.keys_under_root: true
json.add_error_key: true
json.message_key: log
fields:
logtype: docker
# fields_under_root: true
# Autodiscover docker containers and parse logs
providers:
- type: docker
processors:
- add_docker_metadata: ~
# include_lines: ['^ERR', '^WARN']
multiline.pattern: '^\{"log":'
multiline.negate: true
multiline.match: after
logging.level: error
logging.to_files: true
logging.files:
path: /root/filebeat-6.3.1-linux-x86_64/logs
name: filebeat
keepfiles: 7
permissions: 0644
- type: log
paths:
- /var/log/messages
enabled: true
#add fields differd logtype index
fields:
logtype: messages
# fields_under_root: true
output.redis:
hosts: ["192.168.1.104:6379"]
key: "docker-a"
db: 0
timeout: 5
#output.elasticsearch:
# hosts: ["localhost:9200"]
# protocol: "https"
# username: "elastic"
# password: "changeme"
# index: "filebeat-%{[beat.version]}-%{+yyyy.MM.dd}"
shipper:
logging:
files:
rotateeverybytes: 10485760
1 个回复
sunhackboy
赞同来自: