doushi8599 2016-02-03 14:04
浏览 485
已采纳

使用旧注册表使Filebeat从旧文件偏移开始

I'm running Filebeat (used to be know as "logstash-forwarder") on a docker container using prima/filebeat image.

The log files are located in a volume loaded to the container and I want to be able to remove the container and rerun it without it re-sending the logs to the logstash.

I tried to load the /.filebeat registry file as a volume so it will be reloaded on startup but all I get are these errors:

2016/02/03 13:47:29.107457 file_other.go:39: ERR Rotate error: rename /.filebeat.new /.filebeat: device or resource busy
2016/02/03 13:47:29.107788 registrar.go:105: ERR Writing of registry returned error: rename /.filebeat.new /.filebeat: device or resource busy. Continuing..

Does anybody happen to know how to do such a thing?

  • 写回答

1条回答 默认 最新

  • dongtan9518 2016-09-09 11:04
    关注

    With Filebeat version 1.2.3 (other versions may be the same, version 1.3 just came out a few days ago and I've not tried it yet) you will need to specify the path to the registry file. The registry file is the file where Filebeat keeps it read offset (in other words, the current read point in the log(s) file(s) it is processing).

    You need to specify the registry path in your filebeat.yml file, after the prospectors section.

    Something like:

    filebeat:
      prospectors:
        -
          document_type: wildfly-server
          input_type: log
          paths:
            - /path/to/my/log.log
          multiline:
             pattern: 'your pattern'
             negate: true
             match: after
    
      registry_file: /data/.filebeat
    
    logging:
      level: debug
      to_syslog: true
    
    output:
      logstash:
        hosts:
          - "127.0.0.1:5000"
    

    Then in your docker compose file you need to mount a volume pointing to your registry_file path. Something like:

    filebeat:
      image: prima/filebeat:latest
      volumes:
         - /data/filebeat:/data
      hostname: qa
    

    Then you should see in the host the .filebeat file located in the /data/filebeat folder.

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论

报告相同问题?

悬赏问题

  • ¥15 求差集那个函数有问题,有无佬可以解决
  • ¥15 【提问】基于Invest的水源涵养
  • ¥20 微信网友居然可以通过vx号找到我绑的手机号
  • ¥15 寻一个支付宝扫码远程授权登录的软件助手app
  • ¥15 解riccati方程组
  • ¥15 display:none;样式在嵌套结构中的已设置了display样式的元素上不起作用?
  • ¥15 使用rabbitMQ 消息队列作为url源进行多线程爬取时,总有几个url没有处理的问题。
  • ¥15 Ubuntu在安装序列比对软件STAR时出现报错如何解决
  • ¥50 树莓派安卓APK系统签名
  • ¥65 汇编语言除法溢出问题