我在filebeat.yml中有一个探矿者设置大致如下:
filebeat.propectors:
- type: log
paths:
- /tmp/log/typeA*.log
pipeline: "pipelineA"
fields_under_root: true
fields:
logtype: TYPEA
- type: log
paths:
- /tmp/log/typeB*.log
pipeline: "pipelineB"
fields_under_root: true
fields:
logtype: TYPEB
- type: log
paths:
- /tmp/log/typeC*.log
pipeline: "pipelineC"
fields_under_root: true
fields:
logtype: TYPEC
它工作正常,但我需要控制阅读日志。我希望能够控制输入,以便更频繁地读取某些日志(例如,对于pipelineC,每天只读取一次,但对于pipelineA,每分钟读取一次)。我还希望能够忽略超过特定年龄的日志(例如,忽略超过3天的日志)。
我会很感激任何想法。谢谢
想通了。这是解决方案:
filebeat.prospectors:
type: log
paths:
/tmp/log/typeA*.log
ignore_older: 72h
scan_frequency: 10s
pipeline: "pipelineA"
fields_under_root: true
fields:
logtype: TYPEA
type: log
paths:
/tmp/log/typeB*.log
ignore_older: 72h
scan_frequency: 10s
pipeline: "pipelineB"
fields_under_root: true
fields:
logtype: TYPEB
type: log
paths:
/tmp/log/typeC*.log
ignore_older: 72h
scan_frequency: 10s
pipeline: "pipelineC"
fields_under_root: true
fields:
logtype: TYPEC