7,164
edits
Logstash cheat sheet: Difference between revisions
→Filebeat 設定
| Line 132: | Line 132: | ||
:: logstash-input-beats 2.0.2 で対応。とのことだが動いなさそう。確認する。 | :: logstash-input-beats 2.0.2 で対応。とのことだが動いなさそう。確認する。 | ||
'''logstash filter で LSF 互換を保つ''' | '''logstash-input-beats がちゃんとうごくまでは logstash filter で LSF 互換を保つ''' | ||
<syntaxhighlight lang="javascript" enclose="div"> | <syntaxhighlight lang="javascript" enclose="div"> | ||
filter { | filter { | ||
| Line 157: | Line 157: | ||
</syntaxhighlight> | </syntaxhighlight> | ||
'''filebeat.yml | '''filebeat.yml 例''' | ||
<syntaxhighlight lang="yaml" enclose="div"> | <syntaxhighlight lang="yaml" enclose="div"> | ||
############################# Filebeat ###################################### | ############################# Filebeat ###################################### | ||
| Line 173: | Line 173: | ||
# default value 10m is too short. | # default value 10m is too short. | ||
ignore_older: 24h | ignore_older: 24h | ||
fields_under_root: true | fields_under_root: true | ||
| Line 185: | Line 182: | ||
# default value 10m is too short. | # default value 10m is too short. | ||
ignore_older: 24h | ignore_older: 24h | ||
fields_under_root: true | fields_under_root: true | ||
| Line 197: | Line 191: | ||
# default value 10m is too short. | # default value 10m is too short. | ||
ignore_older: 24h | ignore_older: 24h | ||
fields_under_root: true | fields_under_root: true | ||
| Line 209: | Line 200: | ||
# default value 10m is too short. | # default value 10m is too short. | ||
ignore_older: 24h | ignore_older: 24h | ||
fields_under_root: true | fields_under_root: true | ||
| Line 221: | Line 209: | ||
# default value 10m is too short. | # default value 10m is too short. | ||
ignore_older: 24h | ignore_older: 24h | ||
fields_under_root: true | fields_under_root: true | ||