2025-06-05T04:35:48.666Z INFO [beat] instance/beat.go:1059 Process info {"system_info": {"process": {"capabilities": {"inheritable":null,"permitted":null,"effective":null,"bounding":["chown","dac_override","fowner","fsetid","kill","setgid","setuid","setpcap","net_bind_service","net_raw","sys_chroot","mknod","audit_write","setfcap"],"ambient":null}, "cwd": "/usr/share/filebeat", "exe": "/usr/share/filebeat/filebeat", "name": "filebeat", "pid": 7, "ppid": 1, "seccomp": {"mode":"filter","no_new_privs":true}, "start_time": "2025-06-05T04:35:47.720Z"}}} 2025-06-05T04:35:48.666Z INFO instance/beat.go:309 Setup Beat: filebeat; Version: 7.14.1 2025-06-05T04:35:48.667Z INFO [esclientleg] eslegclient/connection.go:100 elasticsearch url: http://101.201.64.180:9200 2025-06-05T04:35:48.667Z INFO [publisher] pipeline/module.go:113 Beat name: d29843b8745b 2025-06-05T04:35:48.668Z INFO [monitoring] log/log.go:118 Starting metrics logging every 30s 2025-06-05T04:35:48.668Z INFO instance/beat.go:473 filebeat start running. 2025-06-05T04:35:48.669Z INFO memlog/store.go:119 Loading data file of '/usr/share/filebeat/data/registry/filebeat' succeeded. Active transaction id=0 2025-06-05T04:35:48.669Z INFO memlog/store.go:124 Finished loading transaction log file for '/usr/share/filebeat/data/registry/filebeat'. Active transaction id=0 2025-06-05T04:35:48.669Z INFO [registrar] registrar/registrar.go:109 States Loaded from registrar: 0 2025-06-05T04:35:48.669Z INFO [crawler] beater/crawler.go:71 Loading Inputs: 1 2025-06-05T04:35:48.670Z INFO [input] log/input.go:164 Configured paths: [/home/bsta/project/oms/logs/*.log /home/bsta/project/oms/logs/*.log.*] {"input_id": "52bf6e82-1152-40b0-b258-6ca233b7d325"} 2025-06-05T04:35:48.670Z INFO [crawler] beater/crawler.go:141 Starting input (ID: 11996131784029043638) 2025-06-05T04:35:48.670Z INFO [crawler] beater/crawler.go:108 Loading and starting Inputs completed. Enabled inputs: 1 root@iZ2ze70gcqx8x6asj2pidjZ:/home/bsta/install/filebeat/config#
时间: 2025-06-05 09:33:02 浏览: 24
### Filebeat 日志分析与配置
Filebeat 是一个轻量级的日志传输工具,用于将日志数据发送到 Elasticsearch 或 Logstash。以下是关于如何查看 Filebeat 日志输出以及排查配置或运行问题的详细说明。
#### 1. Filebeat 日志路径
Filebeat 默认的日志文件路径为 `/var/log/filebeat/`,具体取决于安装方式和配置。如果需要自定义日志路径,可以在 Filebeat 配置文件中设置 `logging` 参数[^6]。
```yaml
logging:
level: debug
to_files: true
files:
path: /home/bsta/project/oms/logs/
name: filebeat.log
rotateeverybytes: 10485760 # 每10MB轮换一次日志文件
keepfiles: 7 # 保留最近7个日志文件
```
通过上述配置,Filebeat 的日志将被写入到 `/home/bsta/project/oms/logs/filebeat.log` 中,并以调试模式记录详细信息。
#### 2. Filebeat 配置示例
以下是一个针对用户需求的 Filebeat 配置文件示例,用于读取指定路径的日志并将其发送到 Elasticsearch:
```yaml
filebeat.inputs:
- type: log
paths:
- /home/bsta/project/oms/logs/*.log
fields:
log_type: application
fields_under_root: true
tags: ["oms_logs"]
output.elasticsearch:
hosts: ["http://101.201.64.180:9200"]
index: "oms-logs-%{+yyyy.MM.dd}"
username: "elastic"
password: "your_password"
setup.template.settings:
index.number_of_shards: 1
index.codec: best_compression
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
```
#### 3. 启动 Filebeat 并查看日志
启动 Filebeat 并确保其正常运行后,可以通过以下命令查看日志输出:
```bash
tail -f /home/bsta/project/oms/logs/filebeat.log
```
如果需要更详细的日志信息,可以临时将日志级别调整为 `debug`,并在问题解决后恢复为 `info`。
#### 4. 常见问题排查
- **Elasticsearch 连接失败**:检查 Elasticsearch URL 是否正确,网络是否可达,以及用户名和密码是否匹配[^7]。
- **日志文件权限问题**:确保 Filebeat 对 `/home/bsta/project/oms/logs/` 目录具有读取权限。
- **索引模板未加载**:运行 `filebeat setup` 命令以加载索引模板和 Kibana 内容[^8]。
```bash
filebeat setup --template -E output.elasticsearch.hosts=["http://101.201.64.180:9200"] -E setup.kibana.host="http://<kibana_host>:5601"
```
#### 5. 其他注意事项
- 如果使用 Docker 部署 Filebeat,请确保挂载正确的日志目录和配置文件[^9]。
- 在生产环境中,建议启用 SSL/TLS 加密以保护数据传输的安全性。
---
阅读全文