Filebeat can't get log written at php by “fwrite”

[vincnetwang0736]

My filebeat can't get the log file that written on php by "fwrite"
Here is my php coding:

Here is my php coding:

$date = date("Y-M-d");
$log_path = JSON_LOG_PATH."_".$date."_".$eventid.".log";

if (!is_file($log_path)) {
    # code...
    if( ($jsonLog=fopen ($log_path,"w")) === FALSE){
        return false;
    }
    $json_string = json_encode($log_json);
    if(!fwrite ($jsonLog,"[".$json_string."]")){ 
        fclose($jsonLog);

        return false;
    }
    fclose ($jsonLog); 
} else {
    $json_string_all = file_get_contents($log_path);

    if( ($jsonLog=fopen ($log_path,"w")) === FALSE){
        return false;
    }
    $data_all = json_decode($json_string_all,true);
    array_push($data_all, $log_json);
    $json_string = json_encode($data_all);
    if(!fwrite ($jsonLog,$json_string)){ 
        fclose($jsonLog);
        return false;
    }
    fclose ($jsonLog); 

And here is my filebeat config:

filebeat.prospectors:

• type: log

  paths:

  • /usr/local/nginx/xxx/accessLog.log

  fields:
  logIndex: nginx
  docType: nginx-access
  project: app-nginx

• type: log
  paths:

  • /usr/local/nginx/xxx/uploads/logs/*.log

  fields:
  logIndex: nginx
  docType: nginx-pro
  project: app-nginx

output.logstash:

The Logstash hosts

hosts: ["xx.xx.xx.xxx:5044"]
ssl.certificate_authorities: ["/etc/pki/tls/certs/logstash.crt"]
ssl.certificate: "/etc/pki/tls/certs/filebeat.crt"
ssl.key: "/etc/pki/tls/private/filebeat.key"

Filebeat can got nginx-access log easily but can't get "/usr/local/nginx/xxx/uploads/logs/*.log"(written in php) at all.
Anyone can give me som advise?thanks a lot!

[ruflin]

Can you enable debug logging in filebeat and share the output?

For your PHP logs: Can you check if the lines have a new line char at the end?