技術標籤：lunixjavalinux

問題描述

• 最近用ELK收集日誌，filebeat掃描一段時間後出現自動關閉現象

• filebeat版本：filebeat-7.10.1-linux-x86_64

• 啟動方式: nohup ./filebeat -e -c filebeat.yml -d "Publish" &
• 執行一段時間後，filebeat自動停止

  2021-02-04T11:28:39.502+0800	INFO	[monitoring]	log/log.go:154	Uptime: 1h26m58.80799461s
  2021-02-04T11:28:39.502+0800	INFO	[monitoring]	log/log.go:131	Stopping metrics logging.
  2021-02-04T11:28:39.503+0800	INFO	instance/beat.go:461	filebeat stopped.
   
  

• 問題分析：

待掃描的檔案長時間沒有新內容寫入，收割機停止工作

• 
  解決方案：

• 自定義Service方式啟動

  vim /usr/lib/systemd/system/filebeat.service
  chmod +x /usr/lib/systemd/system/filebeat.service
  
  systemctl daemon-reload
  systemctl enable filebeat
  systemctl start filebeat

• filebeat.service檔案內容

  [Unit]
  Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
  Documentation=https://www.elastic.co/products/beats/filebeat
  Wants=network-online.target
  After=network-online.target
  
  [Service]
  Type=simple
  Environment="LOG_OPTS=-e"
  Environment="CONFIG_OPTS=-c /usr/local/src/filebeat-7.10.1-linux-x86_64/filebeat.yml"
  Environment="PATH_OPTS=-path.home /usr/local/src/filebeat-7.10.1-linux-x86_64/filebeat -path.config /usr/local/src/filebeat-7.10.1-linux-x86_64/filebeat -path.data /usr/local/src/filebeat-7.10.1-linux-x86_64/data -path.logs /usr/local/src/filebeat-7.10.1-linux-x86_64/logs"
  ExecStart=/usr/local/src/filebeat-7.10.1-linux-x86_64/filebeat $LOG_OPTS $CONFIG_OPTS $PATH_OPTS
  
  Restart=always
  
  [Install]
  WantedBy=multi-user.target