Logstash文件输入:sincedb_path [英] Logstash File input: sincedb_path

问题描述

重新启动Logstash时，有时会发现Logstash复制了日志事件.想知道什么是应用start_position，sincedb_path，sincedb_write_interval配置选项的正确方法.

Upon restarting Logstash, at times observed that Logstash duplicates the log events. Was wondering as to what would be the right way to apply start_position, sincedb_path, sincedb_write_interval configuration options.

• 在同一位置有多个文件时会发生什么情况，如我在下面的示例中所示/home/tom/testData/*.log
• 发生文件旋转时会发生什么情况，例如将XXX.log文件重命名为XXX-<date>.log并且创建了新的XXX.log文件.在这种情况下，名称不会更改，但是inode会更改.

• What happens when there are multiple files in the same location as in my example below /home/tom/testData/*.log
• What happens when the file rotation occurs like for example the XXX.log file is renamed to XXX-<date>.log and a new XXX.log file is created. In this case name doesn't change, but the inode changes.

如果有人能对此有所启发，将不胜感激.

Would highly appreciate if anyone can throw some light on this.

input {
           file {
             path => "/home/tom/testData/*.log"
             type => "log"
             start_position => "beginning"
             sincedb_path => "/persistent/loc"        
             sincedb_write_interval => 10
               }
       }

推荐答案

start_position(开头或结尾)仅用于logstash尚未看到的文件.使用开始"的唯一原因是当您尝试加载较旧的文件时.

start_position (beginning or end) is only used for files that have not yet been seen by logstash. The only reason to use 'beginning' is when you're trying to load older files.

sincedb_path只需是logstash对注册表具有写权限的目录.

sincedb_path just needs to be a directory where logstash has write permission for the registry.

sincedb_write_interval定义logstash应多久写入一次sincedb注册表.较大的值会使您面临逻辑崩溃的风险.

sincedb_write_interval defines how often logstash should write the sincedb registry. A larger value puts you at risk in logstash were to crash.

当您有多个与您的glob匹配的文件时，logstash通过在注册表中具有多个条目来分别跟踪它们.

When you have multiple files that match your glob, logstash tracks them separately by having multiple entries in the registry.

注册表包含inode编号，因此logstash知道在这种轮换类型中该怎么做.

The registry contains the inode number, so logstash knows what to do in that type of rotation.

这篇关于Logstash文件输入:sincedb_path的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！