我正在尝试使用以下配置在 fluentd 中跟踪多个日志:
<source>
type tail
tag es.workers.worker1
format /^\[(?<timestamp>.*? .*?) (?<log_level>[INFO|ERROR][^\]]*)\] (?<message>.*)$/
path /var/log/upstart/worker1.log
pos_file /var/lib/fluentd/pos/-var-log-upstart-worker1.log.pos
</source>
<source>
type tail
tag es.workers.worker2
format /^\[(?<timestamp>.*? .*?) (?<log_level>[INFO|ERROR][^\]]*)\] (?<message>.*)$/
path /var/log/upstart/worker2.log
pos_file /var/lib/fluentd/pos/-var-log-upstart-worker2.log.pos
</source>
<source>
type tail
tag es.workers.worker3
format /^\[(?<timestamp>.*? .*?) (?<log_level>[INFO|ERROR][^\]]*)\] (?<message>.*)$/
path /var/log/upstart/worker3.log
pos_file /var/lib/fluentd/pos/-var-log-upstart-worker3.log.pos
</source>
<source>
type tail
tag es.workers.worker4
format /^\[(?<timestamp>.*? .*?) (?<log_level>[INFO|ERROR][^\]]*)\] (?<message>.*)$/
path /var/log/upstart/worker4.log
pos_file /var/lib/fluentd/pos/-var-log-upstart-worker4.log.pos
</source>
这是行不通的。通常(但并非总是),我只获取第一个文件的日志。有时它是一个不同的文件,但它总是只有一个。关于发生了什么的任何想法?我在 fluentd 错误日志中没有收到任何有意义的错误。