Filebeat |如何为不同的日志路径定义唯一索引？

Question

我正在从两个不同的路径收集日志：

• /var/log/containers/*.log
• /var/log/agents/*.log

我想要每个路径中的文件将被发送到elasticsearch中的不同索引。 我尝试定义 filebeat 配置如下：

    output.elasticsearch:
    protocol: http
    hosts: ["elasticsearch:9200"]
    compression_level: 1
    indices:
    - index: "agent-logs"
      when:
       contains:
        log.file.path: "/var/log/agents/*.log"
    - index: "container-logs"
      when:
       contains:
        log.file.path: "/var/log/containers/*.log"

我也尝试过：

    output.elasticsearch:
    protocol: http
    hosts: ["elasticsearch:9200"]
    compression_level: 1
    indices:
    - index: "agent-logs"
      when.contains:
        log.file.path: "/var/log/agents/*.log"
    - index: "container-logs"
      when.contains:
        log.file.path: "/var/log/containers/*.log"

和：

    output.elasticsearch:
    protocol: http
    hosts: ["elasticsearch:9200"]
    compression_level: 1
    indices:
    - index: "agent-logs"
      when.equals:
        log.file.path: "/var/log/agents/*.log"
    - index: "container-logs"
      when.equals:
        log.file.path: "/var/log/containers/*.log"

但似乎没有任何效果。 请帮忙！

谢谢你

Answer 1

TLDR；

equals

和

contains

不支持全局模式。 您可能想看看

regexp

？或另一个不同的值。

解决方案

这可能效果更好：

output.elasticsearch:
    protocol: http
    hosts: ["elasticsearch:9200"]
    compression_level: 1
    indices:
    - index: "agent-logs"
      when:
       contains:
        log.file.path: "agents"
    - index: "container-logs"
      when:
       contains:
        log.file.path: "containers"