Filebeat include_lines problem


#1

I want to extract the logs that include the "FaceLogBean" ,Configuration file is:

filebeat.prospectors: 
    - input_type: log
      document_type: cloud
      paths:
           - /usr/logs/*.log
      include_lines:["FaceLogBean"]
      multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
      multiline.negate: true
      multiline.match: after
      multiline.timeout: 10s
    output.logstash:
       # The Logstash hosts
      hosts: ["localhost:5044"]

After the configuration, the filebeat startup failed:

 filebeat.service - filebeat
   Loaded: loaded (/usr/lib/systemd/system/filebeat.service; disabled; vendor preset: disabled)
   Active: failed (Result: start-limit) since Fri 2018-03-02 11:41:14 CST; 27s ago
     Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html
  Process: 12829 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)
 Main PID: 12829 (code=exited, status=1/FAILURE)

Mar 02 11:41:14 dongjingang-test3.syswin.com systemd[1]: filebeat.service: main process exited, code=exited, status=1/FAILURE
Mar 02 11:41:14 dongjingang-test3.syswin.com systemd[1]: Unit filebeat.service entered failed state.
Mar 02 11:41:14 dongjingang-test3.syswin.com systemd[1]: filebeat.service failed.
Mar 02 11:41:14 dongjingang-test3.syswin.com systemd[1]: filebeat.service holdoff time over, scheduling restart.
Mar 02 11:41:14 dongjingang-test3.syswin.com systemd[1]: start request repeated too quickly for filebeat.service
Mar 02 11:41:14 dongjingang-test3.syswin.com systemd[1]: Failed to start filebeat.
Mar 02 11:41:14 dongjingang-test3.syswin.com systemd[1]: Unit filebeat.service entered failed state.
Mar 02 11:41:14 dongjingang-test3.syswin.com systemd[1]: filebeat.service failed.

But annotate the code “ include_lines:["FaceLogBean"]”and start the success.
Hope to get help,thank!


(ruflin) #2

Could you check your filebeat log file and share it here. This should contain some more info.

BTW: I tried to edit your post above to make the code parts readable.


#3

Thank you for your reply,I've solved this problem.I add a space behind "include_lines:" and I can run it.


(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.