Elasticsearch + Filebeat + Logstash

Question

我对弹性堆很陌生，最近我试着把原木运到麋鹿堆，但是发现了一些奇怪的问题。有人能给我建议一下这个配置吗。

filebeat.yml
filebeat.inputs:
- type: log
  paths:
    #- /var/log/*.log
    - D:\apps\logs\RGGYSLT-0473\learnings-elasticsearch\*.log
  multiline.pattern: '^\[[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

logstash.conf
input {
    beats {
        type => "v1-elasticsearch"
        host => "127.0.0.1"
        port => "5044"
    }
}

filter {

  if[type] == "v1-elasticsearch" {  
      #If log line contains tab character followed by 'at' then we will tag that entry as stacktrace
      if [message] =~ "\tat" {
        grok {
          match => ["message", "^(\tat)"]
          add_tag => ["stacktrace"]
        }
      }  
  }  
}

output {   
  stdout {
    codec => rubydebug
  }

  # Sending properly parsed log events to elasticsearch
  elasticsearch {
     hosts => ["http://localhost:9200"]
     index => "dhisco-learnings-elasticseach-%{+YYYY.MM.dd}"
     document_type => "%{[@metadata][type]}"
    #user => "elastic"
    #password => "changeme"
  }
}

基巴纳产量-

Jun 7, 2020 @ 23:58:58.067  2020-06-07 23:58:48,480 88900 [http-nio-9090-exec-2] INFO  c.d.l.e.web.HotelController - Brand: RADISSON
2020-06-07 23:58:49,297 88900 [http-nio-9090-exec-3] INFO  c.d.l.e.web.HotelController - Brand: RADISSON

我点击了我的控制器两次，但不幸的是，这两个日志被连在一起，并显示在同一时间戳上。

有人能给我建议吗？

Answer 1

我使用json编码器做了同样的事情，从来没有遇到过任何问题。