0

我有以下日志文​​件作为示例，并希望在logz.io中的一行中查看 JSON 。我使用了几种配置。最后，我在 Filebeat 中使用了以下配置。但是，我仍然单独看到文本文件中的每一行。如果你能指导我，我会很高兴。

文件节拍配置

    filebeat.inputs:
    - type: log
      enabled: true
      paths:
        - /tmp/*.log
      multiline.type: pattern
      multiline.pattern: '%{TIMESTAMP_ISO8601}'
      multiline.negate: true
      multiline.match: after

日志文件

2021-05-07T11:11:31.8298765+02:00 0HM8GHNH0KK9V:00000002 [INF] Request starting HTTP/1.1 GET http://11.11.11.11/swagger/index.html - - (ca22a1cb)
2021-05-07T11:11:31.8302819+02:00 0HM8GHNH0KK9V:00000002 [INF] Request finished HTTP/1.1 GET http://11.11.11.11/swagger/index.html - - - 200 - text/html;charset=utf-8 0.4099ms (791a596a)
2021-05-07T11:11:38.1371767+02:00 0HM8GHNH0KKA0:00000002 [DBG] ###DATA_REQUEST_888888###{
  "operation": "new_business",
  "policy": {
    "originalContractStartTimestamp": 1620165600000,
    "originalContractEndTimestamp": 1651701600000,
    "effectiveContractEndTimestamp": 1651701600000,
    "fees": [],
    "documents": [],
    "invoices": [],
    "productName": "personal-auto",
    "createdTimestamp": 1620377486896,
    "updatedTimestamp": 1620378697551,
    "cancellation": null,
    "depositAccount": null,
    "issuedTimestamp": null,
    "paymentScheduleName": "annually",
    "OriginalContractStart": "2021-05-04T22:00:00Z",
    "OriginalContractEnd": "2022-05-04T22:00:00Z",
    "EffectiveContractEnd": "2022-05-04T22:00:00Z",
    "Created": "2021-05-07T08:51:26.896Z",
    "Updated": "2021-05-07T09:11:37.551Z",
    "Issued": "0001-01-01T00:00:00"
  }
  "endorsementLocator": null
} (0596056d)
2021-05-07T11:11:38.2993754+02:00 0HM8GHNH0KKA0:00000002 [INF] Already stored pricing version is used, calculation date 05/07/2021 08:51:47 (79d888c3)
2021-05-07T11:11:38.3039358+02:00 0HM8GHNH0KKA0:00000002 [INF] Already stored pricing version is used, calculation date 05/07/2021 08:51:47 (79d888c3)
2021-05-07T11:11:38.3093491+02:00 0HM8GHNH0KKA0:00000002 [INF] Already stored pricing version is used, calculation date 05/07/2021 08:51:47 (79d888c3)
2021-05-07T11:11:38.3143367+02:00 0HM8GHNH0KKA0:00000002 [INF] Already stored pricing version is used, calculation date 05/07/2021 08:51:47 (79d888c3)

来自 logz.io 的日志

在此处输入图像描述

4

1 回答 1

1

首先，我更改了 daemonset 配置。将编解码器类型设置为“普通”。

 - name: LOGZIO_CODEC
   value: plain

然后我在 configmap 中使用了下面的多行配置。编解码器类型有重复项。在我更改了 daemonset 编解码器类型之前，以下配置没有帮助。现在它正在按我的预期工作。我可以在一行中看到 JSON。

    filebeat.inputs:
    - type: log
      logzio_codec: "plain"
      enabled: true
      paths:
        - /tmp/*.log
      multiline.type: pattern
      multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
      multiline.negate: true
      multiline.match: after

    processors:
      - add_cloud_metadata: ~
    fields:
      logzio_codec: 'plain'
      token: ${LOGZIO_LOGS_SHIPPING_TOKEN}
      cluster: ${CLUSTER_NAME}
      type: ${LOGZIO_TYPE}
于 2021-05-10T13:22:16.240 回答