https://elasticsearch.cn/question/3409   在这个问题中找到了同样的困境,但是并没有从文章中得到解决方案。。
 
首先我是filebeat->logstash->es 这样的流程架构,fb是和logstash都是6.3的。
 
filebeat配置如下:
 
然后看logstash,我是是这么处理的:
结果索引名变成了:mylog-%{fields}%{cluster}2018.08.07 很明显这俩变量没生效,并没有变成mylog-orderlog20180807这样的格式, 换成了
[fields][cluster] 一样没用 和上面的名字一样。不懂为何不生效,求解
																				首先我是filebeat->logstash->es 这样的流程架构,fb是和logstash都是6.3的。
filebeat配置如下:
#=========================== Filebeat inputs =============================
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
- type: log
  # Change to true to enable this input configuration.
  enabled: true
  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /opt/flogs/*.log
    - /opt/log/orderlog/*.log
    #- c:\programdata\elasticsearch\logs\*
  fields:
      cluster: orderlog
  # Exclude lines. A list of regular expressions to match. It drops the lines that are
  # matching any regular expression from the list.
  #exclude_lines: ['^DBG']
  # Include lines. A list of regular expressions to match. It exports the lines that are
  # matching any regular expression from the list.
  #include_lines: ['^ERR', '^WARN']
  # Exclude files. A list of regular expressions to match. Filebeat drops the files that
  # are matching any regular expression from the list. By default, no files are dropped.
  #exclude_files: ['.gz$']
  # Optional additional fields. These fields can be freely picked
  # to add additional information to the crawled log files for filtering
  #fields:
  #  level: debug
  #  review: 1
  ### Multiline options
  # Mutiline can be used for log messages spanning multiple lines. This is common
  # for Java Stack Traces or C-Line Continuation
  # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
  #multiline.pattern: ^\[
  # Defines if the pattern set under pattern should be negated or not. Default is false.
  #multiline.negate: false
  # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
  # that was (not) matched before or after or as long as a pattern is not matched based on negate.
  # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
  #multilinie.match: after
  multiline.pattern: '^\['
  multiline.negate: true
  multiline.match: after
截取inputs这部分。我已经配置了fileds,设置了k-v然后看logstash,我是是这么处理的:
input {
  beats {
    port => 5044
  }
}
output {
    elasticsearch {
        hosts => "http://xxxxx:xx"
        manage_template => true
        index => "mylog-%{fields}%{cluster}%{+YYYY.MM.dd}"
        template_name => "tmp_mylog"
    }
}
结果索引名变成了:mylog-%{fields}%{cluster}2018.08.07 很明显这俩变量没生效,并没有变成mylog-orderlog20180807这样的格式, 换成了
[fields][cluster] 一样没用 和上面的名字一样。不懂为何不生效,求解
	
1 个回复
spoofer
赞同来自:
而且, 你的output配置少了个 “"” ?