Filebeat 未在 Windows 中启动答案

【问题标题】：Filebeat not starting in windowsFilebeat 未在 Windows 中启动
【发布时间】：2019-06-13 21:59:40
【问题描述】：

面对在 Windows 10 中启动 Filebeat 的问题，我已使用位于我的本地计算机“E:”驱动器中的 elasticsearch 日志文件夹修改了 filebeat 探矿者日志路径，并且我在进行更正后验证了 filebeat.yml 的格式但在启动时仍然低于错误。

Filebeat 版本： 6.2.3

Windows 版本： 64 位

Filebeat.yml（经过验证的 yml 格式）

filebeat.prospectors:
-
    type: log
    enabled: true
    paths:
        - 'E:\Research\ELK\elasticsearch-6.2.3\logs\*.log'
filebeat.config.modules:
    path: '${path.config}/modules.d/*.yml'
    reload.enabled: false
setup.template.settings:
    index.number_of_shards: 3
setup.kibana:
    host: 'localhost:5601'
output.elasticsearch:
    hosts:
        - 'localhost:9200'
    username: elastic
    password: elastic

Filebeat 启动日志：

E:\Research\ELK\filebeat-6.2.3-windows-x86_64>filebeat --setup -e
2018-03-24T22:58:39.660+0530    INFO    instance/beat.go:468    Home path: [E:\Research\ELK\filebeat-6.2.3-windows-x86_64] Config path: [E:\Research\ELK\filebeat-6.2.3-windows-x86_64] Data path: [E:\Research\ELK\filebeat-6.2.3-windows-x86_64\data] Logs path: [E:\Research\ELK\filebeat-6.2.3-windows-x86_64\logs]
2018-03-24T22:58:39.661+0530    INFO    instance/beat.go:475    Beat UUID: f818bcc0-25bb-4545-bcd4-3523366a4c0e
2018-03-24T22:58:39.662+0530    INFO    instance/beat.go:213    Setup Beat: filebeat; Version: 6.2.3
2018-03-24T22:58:39.662+0530    INFO    elasticsearch/client.go:145     Elasticsearch url: http://localhost:9200
2018-03-24T22:58:39.665+0530    INFO    pipeline/module.go:76   Beat name: DESKTOP-J932HJH
2018-03-24T22:58:39.666+0530    INFO    [monitoring]    log/log.go:97   Starting metrics logging every 30s
2018-03-24T22:58:39.666+0530    INFO    elasticsearch/client.go:145     Elasticsearch url: http://localhost:9200
2018-03-24T22:58:39.672+0530    INFO    elasticsearch/client.go:690     Connected to Elasticsearch version 6.2.3
2018-03-24T22:58:39.672+0530    INFO    kibana/client.go:69     Kibana url: http://localhost:5601
2018-03-24T22:59:08.882+0530    INFO    instance/beat.go:583    Kibana dashboards successfully loaded.
2018-03-24T22:59:08.882+0530    INFO    elasticsearch/client.go:145     Elasticsearch url: http://localhost:9200
2018-03-24T22:59:08.885+0530    INFO    elasticsearch/client.go:690     Connected to Elasticsearch version 6.2.3
2018-03-24T22:59:08.888+0530    INFO    instance/beat.go:301    filebeat start running.
2018-03-24T22:59:08.888+0530    INFO    registrar/registrar.go:108      Loading registrar data from E:\Research\ELK\filebeat-6.2.3-windows-x86_64\data\registry
2018-03-24T22:59:08.888+0530    INFO    registrar/registrar.go:119      States Loaded from registrar: 5
2018-03-24T22:59:08.888+0530    INFO    crawler/crawler.go:48   Loading Prospectors: 1
2018-03-24T22:59:08.889+0530    INFO    log/prospector.go:111   Configured paths: [E:\Research\ELK\elasticsearch-6.2.3\logs\*.log]
2018-03-24T22:59:08.890+0530    INFO    log/harvester.go:216    Harvester started for file: E:\Research\ELK\elasticsearch-6.2.3\logs\elasticsearch.log
2018-03-24T22:59:08.892+0530    ERROR   fileset/factory.go:69   Error creating prospector: No paths were defined for prospector accessing config
2018-03-24T22:59:08.892+0530    INFO    crawler/crawler.go:109  Stopping Crawler
2018-03-24T22:59:08.893+0530    INFO    crawler/crawler.go:119  Stopping 1 prospectors
2018-03-24T22:59:08.897+0530    INFO    log/prospector.go:410   Scan aborted because prospector stopped.
2018-03-24T22:59:08.897+0530    INFO    log/harvester.go:216    Harvester started for file: E:\Research\ELK\elasticsearch-6.2.3\logs\elasticsearch_deprecation.log
2018-03-24T22:59:08.897+0530    INFO    prospector/prospector.go:121    Prospector ticker stopped
2018-03-24T22:59:08.898+0530    INFO    prospector/prospector.go:138    Stopping Prospector: 18361622063543553778
2018-03-24T22:59:08.898+0530    INFO    log/harvester.go:237    Reader was closed: E:\Research\ELK\elasticsearch-6.2.3\logs\elasticsearch.log. Closing.
2018-03-24T22:59:08.898+0530    INFO    crawler/crawler.go:135  Crawler stopped
2018-03-24T22:59:08.899+0530    INFO    registrar/registrar.go:210      Stopping Registrar
2018-03-24T22:59:08.908+0530    INFO    registrar/registrar.go:165      Ending Registrar
2018-03-24T22:59:08.910+0530    INFO    instance/beat.go:308    filebeat stopped.
2018-03-24T22:59:08.948+0530    INFO    [monitoring]    log/log.go:132  Total non-zero metrics  
2018-03-24T22:59:08.948+0530    INFO    [monitoring]    log/log.go:133  Uptime: 29.3387858s
2018-03-24T22:59:08.949+0530    INFO    [monitoring]    log/log.go:110  Stopping metrics logging.
2018-03-24T22:59:08.950+0530    ERROR   instance/beat.go:667    Exiting: No paths were defined for prospector accessing config
Exiting: No paths were defined for prospector accessing config

【问题讨论】：

标签： elasticsearch filebeat

【解决方案1】：

检查这条路径${path.config}/modules.d/ 或通过命令行“filebeat.exe 模块列表”检查某些模块是否处于活动状态，这些模块不适用于 windows。

例如，system.yml（模块）不能在普通窗口上运行，因为没有系统日志。但是系统模块默认是激活的。所以你必须先禁用它。如果我启用了它，我会在完全相同的错误消息中运行，并且 filebeat 会停止。

【讨论】：

【解决方案2】：

使用这种格式重写 yml 的第一部分：

filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - /var/log/*.log
    #- c:\programdata\elasticsearch\logs\*

同时删除空的新行并注意缩进。

【讨论】：

【解决方案3】：

我知道这个话题有点老了，但是看看在发布这篇文章时（2019 年 6 月）收到的浏览量，我认为添加更多信息是安全的，因为这相当令人沮丧得到同时很容易修复。

在我解释我做了什么之前，请允许我说我在 Linux 系统上遇到了这个问题，但问题/解决方案在所有平台上应该是相同的。

更新logback-spring.xml并重新启动服务后，它一直拒绝吐回以下错误：

ERROR instance/beat.go:824 Exiting: Can only start an input when all related states are finished: {Id:163850-64780 Finished:false Fileinfo:0xc42016c1a0 Source:/some/path/here/error.log Offset:0 Timestamp :2019-06-13 09:15:35.481163602 -0400 EDT m=+0.107516982 TTL:-1ns 类型:log Meta:map[] FileStateOS:163850-64780}

我的解决方案是简单地编辑 /etc/filebeat/filebeat.yml 并尽可能多地注释内容（回到几乎原始/基本配置）。

完成此操作后，重新启动 filebeat 工作，这最终成为与系统某处的另一个文件重复的路径条目，可能在模块下。

【讨论】：