Hi, I am using filebeat 6.1.3 in windows to read log files from log4j2 to logstash.
When the logfile ratated from xxx.log -> xxx.log.1
logstash received the lines in file xxx.log.1 again
so all the log is read twice.
Can you please tell me if anything wrong in my configs?
log4j2.xml:
<RollingFile name="file2"
append="true"
fileName="C:/xxx/log/log4j2-test.log"
filePattern="C:/xxx/log/log4j2-test.log.%i">
<PatternLayout pattern="${ptn}" />
<Policies>
<SizeBasedTriggeringPolicy size="10 KB" />
</Policies&lgt;
<DefaultRolloverStrategy fileIndex="min" min="1" max="5" />
</RollingFile>
filebeat.yml:
-
type: log
paths:- C:/xxx/log/log4j2-test.log*
close_renamed: true
close_removed: true
output.logstash:
hosts: ["localhost:5044"]
logstash conf:
beats {
port => 5044
}