filebeat安裝的是?filebeat-6.4.2，因為是rpm安裝的，默認的日志路徑是cat /var/log/filebeat/filebeat，從這里面可以看相關的配置錯誤。

filebeat-6.4.2配置如下所示:

setup.template.name: "own*"
setup.template.pattern: "own*"
?

我用 filebeat 推送日志到 es，然后自己寫了一個 module，可以正常解析日志。我在 filebeat.yml 里配置了兩個 index

output.elasticsearch:# Array of hosts to connect to.hosts: ["localhost:9200"]index: "nginx-%{[beat.version]}-%{+yyyy.MM.dd}"indices:- index: "ro-%{[beat.version]}-%{+yyyy.MM.dd}"when.contains:source: "ro"

然后，我把對應的解析放到了 fields.yml 里面，并在filebeat.yml 配置了兩個，我不知道 index 怎么跟
template 做匹配

setup.template.name: "nginx" #setup.template.fields: "${path.config}/fields.yml" setup.template.overwrite: false setup.template.pattern: "nginx-*"setup.template.name: "ro" setup.template.pattern: "ro*"

這樣啟動以后，日志可以正常推送，也能看到兩個 index，但是 ro 的日志字段跟我寫類型不符，全是 string。另外日志會報錯

2018-01-17T17:02:34+08:00 INFO Connected to Elasticsearch version 6.1.1 2018-01-17T17:02:34+08:00 INFO Template already exists and will not be overwritten. 2018-01-17T17:02:35+08:00 ERR Failed to publish events: temporary bulk send failure

filebeat.yml相關的配置如下所示:

###################### Filebeat Configuration Example #########################

# This file is an example configuration file highlighting only the most common
# options. The filebeat.reference.yml file from the same directory contains all the
# supported options with more comments. You can use it as a reference.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/filebeat/index.html

# For more available modules and options, please see the filebeat.reference.yml sample
# configuration file.

#=========================== Filebeat inputs =============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

- type: log

? # Change to true to enable this input configuration.
? enabled: true

? # Paths that should be crawled and fetched. Glob based paths.
? paths:
? ? - /home/wwwlogs/*.log
? ? #- c:\programdata\elasticsearch\logs\*

? # Exclude lines. A list of regular expressions to match. It drops the lines that are
? # matching any regular expression from the list.
? #exclude_lines: ['^DBG']

? # Include lines. A list of regular expressions to match. It exports the lines that are
? # matching any regular expression from the list.
? #include_lines: ['^ERR', '^WARN']

? # Exclude files. A list of regular expressions to match. Filebeat drops the files that
? # are matching any regular expression from the list. By default, no files are dropped.
? #exclude_files: ['.gz$']

? # Optional additional fields. These fields can be freely picked
? # to add additional information to the crawled log files for filtering
? #fields:
? # ?level: debug
? # ?review: 1

? ### Multiline options

? # Multiline can be used for log messages spanning multiple lines. This is common
? # for Java Stack Traces or C-Line Continuation

? # The regexp Pattern that has to be matched. The example pattern matches all lines starting with [
? #multiline.pattern: ^\[

? # Defines if the pattern set under pattern should be negated or not. Default is false.
? #multiline.negate: false

? # Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
? # that was (not) matched before or after or as long as a pattern is not matched based on negate.
? # Note: After is the equivalent to previous and before is the equivalent to to next in Logstash
? #multiline.match: after

#============================= Filebeat modules ===============================

filebeat.config.modules:
? # Glob pattern for configuration loading
? path: ${path.config}/modules.d/*.yml

? # Set to true to enable config reloading
? reload.enabled: false

? # Period on which files under path should be checked for changes
? #reload.period: 10s

#==================== Elasticsearch template setting ==========================

setup.template.settings:
? index.number_of_shards: 3
? #index.codec: best_compression
? #_source.enabled: false

setup.template.name: "own*"
setup.template.pattern: "own*"
#================================ General =====================================

# The name of the shipper that publishes the network data. It can be used to group
# all the transactions sent by a single shipper in the web interface.
#name:

# The tags of the shipper are included in their own field with each
# transaction published.
#tags: ["service-X", "web-tier"]

# Optional fields that you can specify to add additional information to the
# output.
#fields:
# ?env: staging

#============================== Dashboards =====================================
# These settings control loading the sample dashboards to the Kibana index. Loading
# the dashboards is disabled by default and can be enabled either by setting the
# options here, or by using the `-setup` CLI flag or the `setup` command.
#setup.dashboards.enabled: false

# The URL from where to download the dashboards archive. By default this URL
# has a value which is computed based on the Beat name and version. For released
# versions, this URL points to the dashboard archive on the artifacts.elastic.co
# website.
#setup.dashboards.url:

#============================== Kibana =====================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:
?host: "192.168.32.137:5601"

? # Kibana Host
? # Scheme and port can be left out and will be set to the default (http and 5601)
? # In case you specify and additional path, the scheme is required: http://localhost:5601/path
? # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
? #host: "localhost:5601"

#============================= Elastic Cloud ==================================

# These settings simplify using filebeat with the Elastic Cloud (https://cloud.elastic.co/).

# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
# `setup.kibana.host` options.
# You can find the `cloud.id` in the Elastic Cloud web UI.
#cloud.id:

# The cloud.auth setting overwrites the `output.elasticsearch.username` and
# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
#cloud.auth:

#================================ Outputs =====================================

# Configure what output to use when sending the data collected by the beat.

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
? # Array of hosts to connect to.
? # hosts: ["localhost:9200"]
? hosts: ["192.168.32.137:9200","192.168.32.138:9200","192.168.32.134:9200"]
? index: "own"
? # Optional protocol and basic auth credentials.
? #protocol: "https"
? #username: "elastic"
? #password: "changeme"

#----------------------------- Logstash output --------------------------------
#output.logstash:
? # The Logstash hosts
? #hosts: ["localhost:5044"]

? # Optional SSL. By default is off.
? # List of root certificates for HTTPS server verifications
? #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

? # Certificate for SSL client authentication
? #ssl.certificate: "/etc/pki/client/cert.pem"

? # Client Certificate Key
? #ssl.key: "/etc/pki/client/cert.key"

#================================ Logging =====================================

# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
#logging.level: debug

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]

#============================== Xpack Monitoring ===============================
# filebeat can export internal metrics to a central Elasticsearch monitoring
# cluster. ?This requires xpack monitoring to be enabled in Elasticsearch. ?The
# reporting is disabled by default.

# Set to true to enable the monitoring reporter.
#xpack.monitoring.enabled: false

# Uncomment to send the metrics to Elasticsearch. Most settings from the
# Elasticsearch output are accepted here as well. Any setting that is not set is
# automatically inherited from the Elasticsearch output configuration, so if you
# have the Elasticsearch output configured, you can simply uncomment the
# following line.
#xpack.monitoring.elasticsearch:
?

來源:https://elasticsearch.cn/question/3369

總結

以上是生活随笔為你收集整理的filebeat Template 报错(安装的时候遇到错误了用这个方法解决的)的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。