最近使用filebeat把日志推送到ES来方便查看日志,我下载的是.tar.gz格式的压缩包,在网上找了后台自动filebeat的命令,得到启动方式:
nohup ./filebeat -e -c filebeat.yml >/dev/null 2>&1 &
启动后正常在kibana看到日志了,也就以为OK了,可是后来发现不定时间后,filebeat就会自动退出,查看日志,也没发现问题(不用关注日志内容,因为最后解决方案和日志内容没关系
):
INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":22740,"time":{"ms":15}},"tot
INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":22760,"time":{"ms":16}},"tot
INFO beater/filebeat.go:443 Stopping filebeat
INFO crawler/crawler.go:139 Stopping Crawler
INFO crawler/crawler.go:149 Stopping 1 inputs
INFO cfgfile/reload.go:238 Dynamic config reloader stopped
INFO input/input.go:149 input ticker stopped
INFO input/input.go:167 Stopping Input: 16980747810831490809
INFO crawler/crawler.go:165 Crawler stopped
INFO registrar/registrar.go:367 Stopping Registrar
INFO registrar/registrar.go:293 Ending Registrar
INFO [monitoring] log/log.go:153 Total non-zero metrics {"monitoring": {"metrics": {"beat":{"cpu":{"system":{"ticks":22830,"time":{"ms":22838}},"total":{"tic
INFO [monitoring] log/log.go:154 Uptime: 5h1m4.87624067s
INFO [monitoring] log/log.go:131 Stopping metrics logging.
INFO instance/beat.go:445 filebeat stopped.
然后在网上找了好久,都没有找到原因,最后突然想到是不是因为直接终端退出了,后台任务也跟着退出
,然后试了一下,先启动filebeat,然后关闭终端,再进入系统发现,filebeat进程真的也关闭了。
最后还是下载rpm包,然后安装,使用服务的方式启动filebeat就没问题了
yum install filebeat-xxxx.rpm
systemctl start filebeat
systemctl enable filebeat