Filebeat自动关闭问题解决

问题描述

• 最近用ELK收集日志，filebeat扫描一段时间后出现自动关闭现象

• filebeat版本：filebeat-7.10.1-linux-x86_64

• 启动方式:  nohup ./filebeat -e -c filebeat.yml -d "Publish" &
• 运行一段时间后，filebeat自动停止

  2021-02-04T11:28:39.502+0800	INFO	[monitoring]	log/log.go:154	Uptime: 1h26m58.80799461s
  2021-02-04T11:28:39.502+0800	INFO	[monitoring]	log/log.go:131	Stopping metrics logging.
  2021-02-04T11:28:39.503+0800	INFO	instance/beat.go:461	filebeat stopped.

   

• 问题分析：

        待扫描的文件长时间没有新内容写入，收割机停止工作

• 
  解决方案：

• 自定义Service方式启动

  vim /usr/lib/systemd/system/filebeat.service
  chmod +x /usr/lib/systemd/system/filebeat.service
  
  systemctl daemon-reload
  systemctl enable filebeat
  systemctl start filebeat

   

• filebeat.service文件内容

  [Unit]
  Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
  Documentation=https://www.elastic.co/products/beats/filebeat
  Wants=network-online.target
  After=network-online.target
  
  [Service]
  Type=simple
  Environment="LOG_OPTS=-e"
  Environment="CONFIG_OPTS=-c /usr/local/src/filebeat-7.10.1-linux-x86_64/filebeat.yml"
  Environment="PATH_OPTS=-path.home /usr/local/src/filebeat-7.10.1-linux-x86_64/filebeat -path.config /usr/local/src/filebeat-7.10.1-linux-x86_64/filebeat -path.data /usr/local/src/filebeat-7.10.1-linux-x86_64/data -path.logs /usr/local/src/filebeat-7.10.1-linux-x86_64/logs"
  ExecStart=/usr/local/src/filebeat-7.10.1-linux-x86_64/filebeat $LOG_OPTS $CONFIG_OPTS $PATH_OPTS
  
  Restart=always
  
  [Install]
  WantedBy=multi-user.target