filebeat版本問題導致logstash無法處理接收到的日誌
阿新 • • 發佈：2020-11-13
整體架構：filebeat-》logstash-》elasticsearch-》kibana，logstash的配置生成索引
現象：2臺應用伺服器【filebeat版本不一樣】，1臺logstash+es+kibana，kibana上沒有其中一臺的日誌索引
logstash報錯：
[logstash.outputs.elasticsearch][main]..........."failed to parse field[host] of type [text] in document with 'bQV9sXUBFKchuFQTGB1a',Preview of field's value:'xxx'", "cau
sed by"=>{"type}=>"illegal_state_exception",“reason"=>"Can't get text on a START_OBJECT at 1:222"
除錯：從源頭開始查，（懷疑是filebeat版本問題）
1.更改filebeat的配置，將蒐集到的資料輸出到檔案
output.file: path: "/tmp/filebeat" filename: filebeat
最後檢視對比
"version":"6.2.4"
{"@timestamp":"2018-08-23T02:34:30.957Z","@metadata":{"beat":"filebeat","type":"doc","version":"6.2.4"},"source":"/var/log/maillog","offset":2093185,"message":"2018-08-2
3 10:34:30 postfix/cleanup[11289]: 41wpQW4fsgz5WhW0: milter-reject: END-OF-MESSAGE from vip.admin.net[18.24.24.109]: 4.7.1 Spam message rejected; from=\u003creputation@h
ahaha.com\u003e to=\[email protected]\u003e proto=ESMTP helo=\u003cvip.admin.net\u003e","prospector":{"type":"log"},"beat":{"name":"smtp_02","hostname":"smtp_02
","version":"6.2.4"}}"version":"6.3.2"
{"@timestamp":"2018-08-23T02:05:10.172Z","@metadata":{"beat":"filebeat","type":"doc","version":"6.3.2"},"message":"2018-08-23 10:05:04 postfix/smtp[27215]: 41wncZ3yslz9x
BFm: from=\[email protected]\u003e, to=\[email protected]\u003e, relay=none, delay=419, delays=388/0.03/31/0, dsn=4.4.1, status=deferred (connect to test.com[19.24.31.
13]:25 : Connection timed out)","prospector":{"type":"log"},"input":{"type":"log"},"beat":{"hostname":"hkmail","version":"6.3.2","name":"mail_01"},"host":{"name":"mail_01
"},"source":"/var/log/maillog","offset":2135359} 果然是6.3.2後面多了一個 host 欄位，看了下這個欄位內容在beat 裡面已經有了，可以在logstash中丟掉。解決
filter {
mutate{
remove_field => "host"
}
...
}