Filebest not reading log files whos names as numeric only

Elastic Stack Beats
1

I have log files whose names are in numbers only like "34567854322", these are an application logs and I don't have control to append any extension.

Blockquote
ls -l
total 12
-rw-rw-r-- 1 barakat barakat 1254 Nov 2 13:09 508747530172
-rw-rw-r-- 1 barakat barakat 1254 Nov 2 13:08 513655054771
-rw-r--r-- 1 root root 1254 Nov 8 22:51 5136550547712

My config is below:

Blockquote
paths:
- /var/report/api/*

Blockquote
filebeat test config
Config OK

Those reports contain long one liner data and i dont have any exclusion, ignore or multi-line expression defined so pretty simple setup.

EDIT:

So I checked the logs and filebeat is picking those files but it is not pushing the data to elasticsearch

Blockquote
Nov 8 23:55:58 localhost filebeat[25168]: 2021-11-08T23:55:58.825+0400#011INFO#011[input.harvester]#011log/harvester.go:309#011Harvester started for file.#011{"input_id": "b9b872d3-412a-421f-9b66-ba2473c7d94a", "source": "/var/www/vhosts/example.com/var/report/api/508747530172", "state_id": "native::1977181-66306", "finished": false, "os_id": "1977181-66306", "old_source": "/var/www/vhosts/example.com/var/report/api/508747530172", "old_finished": true, "old_os_id": "1977181-66306", "harvester_id": "1cf78a3a-ee03-49de-9113-17c9fcd4f4aa"}

File content:

Blockquote
"Fatal Error: 'Uncaught Error: Class 'Mobile\CardApi\Model\DeleteSavedCardManagement' not found in /var/www/vhosts/example.com/vendor/magento/framework/ObjectManager/Factory/AbstractFactory.php:121\nStack trace:\n#0 /var/www/vhosts/example.com/vendor/magento/framework/ObjectManager/Factory/Compiled.php(108): Magento\Framework\ObjectManager\Factory\AbstractFactory->createObject('Mobile\\CardApi\\...', Array)\n#1 /var/www/vhosts/example.com/vendor/magento/framework/ObjectManager/ObjectManager.php(56): Magento\Framework\ObjectManager\Factory\Compiled->create('Mobile\\CardApi\\...', Array)\n#2 /var/www/vhosts/example.com/vendor/magento/framework-message-queue/ConsumerFactory.php(163): Magento\Framework\ObjectManager\ObjectManager->create('Mobile\\CardApi\\...')\n#3 /var/www/vhosts/example.com/vendor/magento/framework-message-queue/ConsumerFactory.php(101): Magento\Framework\MessageQueue\ConsumerFactory->getHandlersFromCommunicationConfig('async.mobile.ca...')\n#4 /var/www/vhosts/example.com/vendor/magento/fram' in '/var/www/vhosts/example.com/vendor/magento/framework/ObjectManager/Factory/AbstractFactory.php' on line 121"

2

Those reports contain long one liner data and i dont have any exclusion, ignore or multi-line expression defined so pretty simple setup.

Those files have just one long line?

Filebeat needs a newline character after the last line in the file to be able to read it. [documentation].

3

they all have long single line and they dont have new line char.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.