ELK堆栈+用于收集Rails日志的Filebeat

我已经在虚拟机上安装了ELK堆栈，并且我想从一些Ruby on Rails应用程序收集日志。ELK堆栈+用于收集Rails日志的Filebeat

在每个虚拟机在那里我有我有这个配置安装Filebeat Rails应用程序：

filebeat: 
    prospectors: 
    - 
     paths: 
     - path_to_rails_log_file.log 
     input_type: log 
     fields_under_root: true 
     fields: 
     tags: ['json'] 

output: 
    logstash: 
    hosts: ["192.168.1.232:5044"] 
    bulk_max_size: 1024 
    tls: 
     certificate_authorities: ["path_to_certificate.crt"] 

shipper: 
logging: 
    files: 
    rotateeverybytes: 10485760 # = 10MB

在VM与ELK堆栈我有这个02-beats-input.conf：

input { 
    beats { 
    port => 5044 
    ssl => true 
    ssl_certificate => "/etc/pki/tls/certs/filebeat-forwarder.crt" 
    ssl_key => "/etc/pki/tls/private/filebeat-forwarder.key" 
    } 
} 

filter { 
if [tag][json] { 
    json { 
    source => "message" 
    } 
} 
} 
output { 
elasticsearch { 
    hosts => "localhost:9200" 
    manage_template => false 
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" 
    document_type => "%{[@metadata][type]}" 
} 
}

我不明白为什么在Kibana的web界面我的日志看起来像：

message: {"method":"GET","path":"/","format":"html","controller":"application","action":"index","status":200, "duration":7.91,"view":0.31,"db":0.0,"ip":"req_ip","route":"application#index","request_id":"some_id","source":"127.0.1.1","tags":["request"],"@timestamp":"2017-02-10T06:52:01.984Z","@version":"1"} @version:1 @timestamp:February 10th 2017, 08:52:10.451 offset:25,747 type:log tags:json, beats_input_codec_plain_applied beat.hostname:deployer-VirtualBox

我愿意ke，如果可能，每个条目都是没有这个密钥的密钥“消息”下的内容。

我在做什么错？ :(

附言：我的Rails日志是JSON格式，我读从Filebeat该文件。

来源

2017-02-10 kitz

在Logstash配置你应该用if [tags][json] {

更换 if [tag][json] {

来源

2017-02-10 21:54:22 Alexey

ELK堆栈+用于收集Rails日志的Filebeat

回答

相关问题