My log format is a json string per each line as below.
{"level":"INFO","message":"Loading database shards","source":"UBS.Bootstrap","details":"","type":"ubs-log4net","@version":1,"host":"JERRYWANG01","@timestamp":"2019-03-16T02:36:26,292"}
{"level":"INFO","message":"1 database servers are detected","source":"UBS.Data.Sharding.ShardManager","details":"","type":"ubs-log4net","@version":1,"host":"JERRYWANG01","@timestamp":"2019-03-16T02:36:31,659"}
My Logstash 2.4 is configured with tcp input as below.
input {
tcp {
port => 6001
codec => json_lines { }
}
}
It works well when I send the log file directly to TCP port 6001.
Now I want to transfer the logs via filebeat. Because I am using an old version logstash , I choose filebeat 1.3.1
First added beat
input in logstash
input {
beats {
port => 5044
codec => json_lines { }
}
}
And here is filebeat.yml
filebeat:
prospectors:
-
paths:
- C:\Users\Jerry.Wang\logs\*.log
input_type: log
registry_file: "C:/ProgramData/filebeat/registry"
output:
logstash:
# The Logstash hosts
hosts: ["192.168.2.99:5044"]
I can see logs are transferred successfully from filebeat output, but it is not stored by logstash. What could be wrong?