|
|
vim /etc/filebeat/filebeat.yml 8 F+ V/ r8 {+ H- L$ @
: v. g! A4 ^. x& ?" w1 ]
4 I' D7 Q% X6 T p
* ?# l- b/ k$ n; q0 C- afilebeat.inputs:
$ J: X1 ]( x- A/ g. r1 m - type: log
3 |9 w M7 m. |+ W enabled: true
: K$ H5 g. |/ l `+ w. J paths:
! S* ~+ v2 _( }( b& p+ h" m5 E7 v - /var/log/messages
2 }! R( V- k, ^* u tags: ["messages"]
2 {$ l7 S9 N$ d" n fields_under_root: true
0 I( q9 l V; `/ _5 Z3 H
6 E' y( X# Q7 e" n5 t - type: log
" ?% i# r. f. q2 ?/ q$ p0 Y6 | enabled: true0 r: ^# I. t- m$ R# u$ H, z- t
paths:& o1 B( R0 G7 b! b$ c
- /var/log/nova/nova-compute.log
# U+ h3 V2 r6 T: G% }! \ tags: ["nova-compute"]! V. b0 K D/ u7 m1 [+ N+ F6 t3 f
fields_under_root: true9 t: w$ u5 I8 M6 Y" ~' z C
\0 c3 W3 T `1 v* Q' x. V
- type: log
- H; S1 f9 I" a: n4 o enabled: true
. o* ^2 e8 a2 @ paths:0 f" K* L# A. {
- /var/log/nova/nova-manage.log
1 Q5 l9 t# l) g2 V H& v tags: ["nova-manage"]
9 |6 [4 l9 P7 r0 B6 Q9 m6 F fields_under_root: true
* m) Y, a; x. G2 b7 y0 M4 U1 k ~( S, P$ {. e/ K) e% V' L
- type: log
+ ~2 S! e* \- J8 v1 X' _4 V% c enabled: true) d L( \( q3 J2 \9 [7 {' E
paths:% I0 p8 `% i6 r* y' v% a7 N$ p
- /var/log/nova/scheduler.log
% i( U5 F* j( q1 p ~ U tags: ["scheduler"]
$ } {- U/ ?+ E6 E fields_under_root: true
8 }) h5 ~8 o$ u
) g$ Q! L) w3 y& Z" m& V& a - type: log
& t' \ `, g9 \$ X enabled: true! p4 X' c% c' t. z5 ]+ N \4 C
paths:
* V2 [) S u* H s z - /var/log/nova/conductor.log6 k! K% T2 b2 B6 K/ d
tags: ["conductor"]% d5 a2 A* B! s d1 C' p! }1 k G
fields_under_root: true" M8 e9 I9 H- U: i6 ` u" q
. E+ N9 H# H6 h7 d, U3 M# |+ \8 H
- type: log
# v- w. E5 q' E. X+ U9 A5 N' | enabled: true5 Q' F/ f& e7 _
paths:
' y) `" s$ M( ~4 X" l( Y - /var/log/nova/cert.log
. X# j' V* e# ]4 u0 Q) W$ |9 V tags: ["cert"]5 y6 R( `$ ?( ^) ^' i+ S# w
fields_under_root: true: S; w) i$ A2 g6 m; s
1 a# x/ l! ]. `$ S* j! I- t' I
- type: log
9 `4 a5 @) h! `+ n; p+ g enabled: true
7 X" d! w: S; }/ v paths:" z6 v; z5 v! G1 g- Q! [
- /var/log/nova/consoleauth.log ' R, u0 F- O- W$ x+ n o
tags: ["consoleauth"]
7 Q' j+ s% t1 M fields_under_root: true/ H" H9 B% E5 d1 h; z* }! ~
% Z: }( _) n# k9 E. t - type: log
. j5 n: i1 H8 M. c% F7 b, Z0 h enabled: true0 X2 \, y& j2 V- J% f) R
paths:* N3 b( |/ s2 w5 R% J! _
- /var/log/nova/nova-novncproxy.log
6 D) [4 `% s" A* K+ ^- D tags: ["nova-novncproxy"]* b W8 ^ d+ Z5 o R0 Y
fields_under_root: true
4 X+ m! Z8 a6 ?! x$ P p* O7 M& r8 u: D; c T4 M% o
- type: log Z) n1 k5 \# r6 @+ s1 I! n4 R
enabled: true
' |% \' K( `! C6 w6 Z: _7 V paths:* J+ L" C. J* [- L) b
- /var/log/rabbitmq/rabbit*.log* {8 q8 ?' [+ A7 r: a6 e1 d
tags: ["rabbit"]$ h5 n, m' z5 j
fields_under_root: true
6 _4 c" {. A' z4 H
; P3 H& E" U7 @2 V - type: log( R+ h$ Z" f4 S% A1 n
enabled: true
9 ~' L0 p" x4 n# X. F# x paths:5 X9 R! V: S) O& |' Q
- /var/log/glance/*.log
- q y+ H' j+ l$ ^7 Y ], j$ N9 d tags: ["glance"]
# L+ S# z, J4 R- ^3 G; N8 j fields_under_root: true+ h0 {$ P* k7 k' J" C& Z# H3 S) c
8 G! B6 F$ V) }$ ]# `4 J$ g - type: log9 B% V! q3 A7 z2 J+ g0 p7 M
enabled: true9 l) u0 a: B' j# [5 I6 k, o6 k- y$ }
paths:
6 S" y! P3 h% K6 s - /var/log/neutron/openvswitch-agent.log8 ^+ j. O, k+ U8 z6 L, l1 F# u
tags: ["openvswitch-agent"]. e! i4 q. H+ ^- T
fields_under_root: true+ |% k$ ]- _. ]) n2 d
- D' C7 E X% y/ F) p - type: log
, _0 H4 x7 @- F: v0 t- v/ o enabled: true
0 @+ }8 g9 G9 G, @: }- n# N) i paths:3 S& q! t9 a5 p# T+ q9 D/ W
- /var/log/kuryr/kuryr-controller.log
! `) i, f- J Y) c- h tags: ["kuryr-controller"]
3 c9 I. s% o' _3 m0 L fields_under_root: true
# ~# j0 p9 a$ I5 s: a
& ?$ O! {2 f; k5 @7 c- k, l" y9 J - type: log
* {+ a$ s& m# d2 _ enabled: true
- O6 ]: s* f# f4 G: }+ U paths:
5 n& c4 T U- ]$ y: [2 P/ _2 M+ F - /var/log/keystone/keystone.log3 I. B& k k- x% ^ z
tags: ["keystone"]1 q+ y/ W& n# A- A0 c! K! g- g
fields_under_root: true2 z) T( d& Z& N. t2 g
3 k, M, m. J) e; q
output.elasticsearch:
$ W/ J2 e0 { y, r, e, Y! ? hosts: ["172.24.110.125:9200", "172.24.110.127:9200"]% n% Q C3 _; L ]( W) I2 R
1 k; X' G* M- r+ E username: elastic: [9 c8 \8 T) e m# Z
password: Cxxxx
) B" F! `6 T, [# t% n indices:
3 h6 l; s" y$ ^' ?& Q' M - index: "compute_messages-error-%{[agent.version]}-%{+yyyy.MM.dd}"+ p. a1 o0 S3 a5 ^" l' V
when:) U; J7 ^) c& c3 z) @* b" b( z
or:
8 V7 s( A2 w* w- {) n" B - contains:" a0 D7 ^6 V Y1 ]$ i- U
tags: "messages"
! P3 I3 k% I% f7 J3 S message: "err"7 u& ^' B H) n: D
- contains:3 i& R& [7 {+ E* M z/ C/ F+ q
tags: "messages"' g' I1 d0 y/ s6 t, [- s+ O
message: "ERR"2 m; D6 f8 q& G: i
- contains:
3 c0 a2 M) t1 K! v! F tags: "messages"3 C. [( ?' X0 Z j4 F. \' {- V3 j' I
message: "fail"$ p( S; A* Y. J' A- \
- index: "compute_messages-%{[agent.version]}-%{+yyyy.MM.dd}"& [# A) i1 e8 z- k, A: q; t
when.contains:- _2 r2 ]9 a6 x/ k
tags: "messages"
" z4 q2 x5 _( B - index: "compute_nova-compute-error-%{[agent.version]}-%{+yyyy.MM.dd}"8 h* Q8 x( V, j* i$ ^
when:
5 g1 X7 J8 T+ b0 u3 u' M or:
$ T8 @. ]) m& q5 Z - contains:
3 c& x+ v+ N9 a* \/ S, U% l tags: "nova-compute"1 X( a) D# M3 v1 C( Z* s
message: "err", U7 L1 @5 E" R
- contains:
4 D. u ^) z r0 | tags: "nova-compute", W* F# v4 y( g" ]# n/ e
message: "ERR"# x7 P4 ?* N2 j" Q' V( R
- contains:7 m( o f- \; j V
tags: "nova-compute"
0 g5 v. _4 l* W' }1 i0 l& W& g. o& S2 Q message: "fail"( Z, _2 s" j6 h! Q3 h9 i! x6 V
- index: "compute_nova-compute-%{[agent.version]}-%{+yyyy.MM.dd}"
' @( n* O- O# K, n" q0 f' v when.contains:
: Q: L& [7 C" D. d, X$ A" { tags: "nova-compute"
$ u$ F( J9 z# \8 Q; [0 l! m8 z. f0 H i9 m
- index: "controller_nova-manage-error-%{[agent.version]}-%{+yyyy.MM.dd}"
" v q4 p2 e* a5 ]1 b" e2 \ when:
+ E8 m- l) ^( a. U3 Q or:
T: @( B/ ~) L - contains:
Z: I- M) z& T4 v( h* n tags: "nova-manage"
& W, M3 ?5 N, T* K+ a1 J6 h5 b) Z message: "err"
, J% r: ]8 Q, l% T3 X3 D - contains:
2 b4 l+ d; j& v tags: "nova-manage"5 T& ^8 l! B! P
message: "ERR", r! t: @% E5 H( N6 R5 m2 `
- contains:
; S' u8 Y8 _3 ?8 G; } tags: "nova-manage": \1 F0 @. g( e# |
message: "fail"
2 |3 P1 f4 o5 N" }0 a8 d - index: "controller_nova-manage-%{[agent.version]}-%{+yyyy.MM.dd}"
' s+ C. j% j, G% l( H4 r y when.contains:! o6 ~+ U7 R) ?, Z R7 h
tags: "nova-manage"
T- P# k) a3 ^) u8 |0 @/ D& Q& |) ]" D) v
- index: "controller_scheduler-error-%{[agent.version]}-%{+yyyy.MM.dd}"
& |0 x: X3 d0 J I when:) k! D6 S# U! t% f
or:: Q7 U' T; g' ?
- contains:
w% D; M* a2 Q- Z tags: "scheduler"" a* |# M; _+ P$ i$ F' P
message: "err"
E9 G0 I: k5 K9 d# U - contains:
- s+ C: b+ H& P6 H* W2 t tags: "scheduler": Q! C7 J! P P2 E: I- B( ^& h
message: "ERR"
# R1 g. z7 Z7 X0 o7 g) [5 `) _ - contains:) J! k& w! R% Z0 o6 M# z. ^5 A
tags: "scheduler"7 y7 d4 ]9 ]. r5 [& }
message: "fail"
- d: j4 Q* |" Y9 _ - index: "controller_scheduler-%{[agent.version]}-%{+yyyy.MM.dd}"
7 x8 n6 N- H: f when.contains:
k) P8 y7 s7 c; @) | tags: "scheduler"8 T( P+ A; X$ ?2 L+ U
# R5 f8 h0 a, i& A8 c - index: "controller_conductor-error-%{[agent.version]}-%{+yyyy.MM.dd}"
7 E' H% x& o* m6 t when:0 q2 s2 h @+ P* P( D0 M3 T# ~# N( s
or:" u: X* s* K4 ]0 d
- contains:* }* a- W& F( N: i1 x. y
tags: "conductor"
' ~9 C: D/ U; Z& v) Y; n! F message: "err"* M7 Z' d# f) L5 w5 {% w
- contains:# @$ ]# z6 A( P8 l; r
tags: "conductor"0 k' X5 ?+ ], L, U8 D7 E" P
message: "ERR"/ C6 C% N5 ~2 r# n; U
- contains:
/ {! p" e0 V2 r tags: "conductor"
; U8 ]+ ~0 V% b G e message: "fail"$ b7 b3 T# D0 H3 p2 C! {& I
- index: "controller_conductor-%{[agent.version]}-%{+yyyy.MM.dd}"/ ~0 T8 K* K7 a" ^ D
when.contains:# L5 c" o7 v+ K* [8 ?4 r
tags: "conductor"* Q s' y9 M' _; y. `
( B3 o. T$ W5 `* _5 Q - index: "controller_cert-error-%{[agent.version]}-%{+yyyy.MM.dd}"7 L7 N$ F* w/ Q0 T, t) f1 ^7 X
when:
; D0 Q6 L8 s; x t& c! m( n# j or:
" u+ `4 _( Q. C- a* M - contains:0 G& r/ D9 B- h( }
tags: "cert". P/ R3 r+ t4 I
message: "err"
( H; S% b: c) T3 X4 o - contains:+ R0 y, g0 M }% B+ s$ C
tags: "cert"
7 O: ^" Q! \* K" a message: "ERR"
) ~) C% E1 N% P1 z m! A - contains:
/ r- f" N# u9 w; g" F) B' y( i tags: "cert": c$ i2 B m; @$ A; \/ w% N' z
message: "fail"
' L; T2 h! c! L- w9 z4 l - index: "controller_cert-%{[agent.version]}-%{+yyyy.MM.dd}"% i. _+ X' r, E+ F* m
when.contains:1 Z$ z4 _! O$ B& \% v0 t
tags: "cert"
1 r1 {! A1 p7 O
: F# ?3 l# k" K" y6 J! u2 G - index: "controller_consoleauth-error-%{[agent.version]}-%{+yyyy.MM.dd}"* B& A- M6 x4 d ?2 o1 C% g; u2 j
when:7 k- l `* h+ G1 w3 c& F$ ~7 O
or:
6 V' u8 }- o4 ~# l0 W/ L' E$ ] - contains:* P* \$ J. S, F- \* }& z
tags: "consoleauth"; ~2 W) V% G8 R4 }' y
message: "err"
4 @- F3 i0 k/ p% q9 o0 ] - contains:. L9 w6 G" @2 W5 d7 G+ F2 O
tags: "consoleauth"
" [' Z( A' ?$ \ message: "ERR"
1 J3 j+ @8 v5 i - contains:* t- C& C/ R) Z7 V) e9 m
tags: "consoleauth"8 N7 r: S) O% ~& q F! f# X+ g
message: "fail"
+ M( u2 ]6 i4 W: p/ u - index: "controller_consoleauth-%{[agent.version]}-%{+yyyy.MM.dd}"
, g6 K. ^2 b. V: I when.contains:
6 d9 p, h8 i; S8 g% n) p* j tags: "consoleauth"% x0 ?/ u# h! F( H
& N3 ~3 x" A, L2 h, e$ ?2 F9 ? - index: "controller_nova-novncproxy-error-%{[agent.version]}-%{+yyyy.MM.dd}"+ @" [7 e6 @( Y
when:
, c6 U5 V. T ` or:- @6 |6 W$ L$ c& k/ l
- contains:
5 d v! N, s& q! _5 q, _ tags: "nova-novncproxy", s% R; _; P; H9 W, e- Q
message: "err"6 ^' V* ~- k) q8 I, r
- contains:/ y D6 X! |5 w, ?
tags: "nova-novncproxy"
& F. t7 e. j: ~$ G9 ?/ B message: "ERR"0 {7 B5 n, T3 @, N% p1 X% ^
- contains:
0 o- x- N" g) F, ? tags: "nova-novncproxy"
$ l; E1 V$ P% n8 z/ j9 x9 G message: "fail"
/ S1 T' Q& ^! C4 b r; g1 ?# p T - index: "controller_nova-novncproxy-%{[agent.version]}-%{+yyyy.MM.dd}"% m# |% \' h! E% J9 N
when.contains:1 |5 d* ^( b# _7 v
tags: "nova-novncproxy"' P Z6 R: n& n6 i0 ~
8 W9 Z; L- `' w. i
- index: "controller_rabbit-error-%{[agent.version]}-%{+yyyy.MM.dd}"
/ l0 j. A( W+ r6 u$ p' a when:
' X6 W- C, k; k1 p or:$ F, J! U" g7 T r. g9 b( `
- contains:
$ J' _7 |8 |4 { tags: "rabbit"
3 K' F0 U9 s r/ r message: "err"% U4 Y/ Z3 _8 J s, d- Z
- contains:1 F. |) f8 B1 H; |
tags: "rabbit", P3 Q$ W l4 q
message: "ERR", ]# _2 V$ u! v/ V2 T
- contains:
! t7 _' `. G& ^( |) j, r- v7 a3 P tags: "rabbit"
, E" g* s" k- m0 T* U message: "fail"
3 N6 i" ^" W% j) n6 f2 ~7 @& _) A* | - index: "controller_rabbit-%{[agent.version]}-%{+yyyy.MM.dd}"+ p4 Z: u, L! [$ j
when.contains:# I+ I! W* s( k! y0 Y
tags: "rabbit"6 q- S g. Q% h2 C( M2 i
) ?' h& u' m- X0 J# u
- index: "controller_glance-error-%{[agent.version]}-%{+yyyy.MM.dd}"3 n+ U1 q$ B5 v" ^$ o2 J
when:
% |4 F7 z8 k5 J0 a8 o) a or:
8 w* S/ [& Z% S/ Q& S& U" ? - contains:
- M/ _% S& h" ]8 V tags: "glance"
5 b9 X8 H; p* }1 }# Z% N6 \ message: "err"' I% s3 P1 z" h) r; B9 m
- contains:
( m$ D! Q9 `* y$ J tags: "glance"
6 x N" P, p$ D, G. m/ w* y2 M9 q4 H message: "ERR"
& B5 y9 B6 A! M# {! G& M3 \ - contains:
7 }2 ?9 X6 g. |& j. ~- ~+ y, n tags: "glance"
; G& L) f# |' J/ t) B6 u- q message: "fail"
3 m& ~. Q' E' z3 t$ c* b; K - index: "controller_glance-%{[agent.version]}-%{+yyyy.MM.dd}") J1 s$ g3 s# x s) Z7 Z+ t
when.contains:8 l' {6 t& } ~5 s5 r
tags: "glance"; V- ]& m5 c5 h9 J$ v* d
, j2 g) n1 a, u; Z, \2 A - index: "controller_openvswitch-agent-error-%{[agent.version]}-%{+yyyy.MM.dd}"
; \* W2 L% H f; t2 N9 c6 h when:8 a6 w- Y0 {2 h: O' a& a
or:
; ]* W4 N: G/ `+ n. C - contains:& I5 u0 U! l. W6 P& M2 B# C1 d
tags: "openvswitch-agent"
+ k& A* T2 x8 P/ |& r! r/ x! N* x message: "err"* j( p# b1 U0 P- `7 k( v
- contains:
% ^1 q; A, U% G4 ~, p tags: "openvswitch-agent"% x2 m* ?/ K* h Q" f- Z8 W" U
message: "ERR"4 p" ~, P) c, C* h) H e
- contains:
( H; U, E G" g7 W, [5 v8 i tags: "openvswitch-agent"
3 G& ]9 D e9 V message: "fail"
4 i% |' ?/ f, k$ s! o - index: "controller_openvswitch-agent-%{[agent.version]}-%{+yyyy.MM.dd}"& n( g, |7 c! k4 I5 B8 [& }
when.contains:' a+ F5 L! d4 n8 M4 U4 u& r' G
tags: "openvswitch-agent"
: o3 G0 f! r* ]8 A; D5 r+ }" C- V2 X W
- index: "controller_kuryr-controller-error-%{[agent.version]}-%{+yyyy.MM.dd}"
4 _* ^: e6 J" n# v6 s when:; v% `$ j( c1 a4 ?- f$ i( S! e1 z* v7 ~* W
or:
. \0 I* c( ^. `* G - contains:
# L7 n* L- k$ B' ~2 i tags: "kuryr-controller"6 e3 J: p" L& Y6 [# i$ r
message: "err"+ t" l8 V0 `" q; A$ O/ f
- contains:
& p) C; e" c; x tags: "kuryr-controller"
( }8 P! t7 i! ]+ J1 o& B6 I message: "ERR"
9 z W1 ]. I. P: O: a9 ] T - contains:
/ r5 m9 [" C! Z e, o- z tags: "kuryr-controller"' m# l9 n0 n/ D1 b: ?" B
message: "fail": I* R* y7 v/ E8 g8 M0 P* `
- index: "controller_kuryr-controller-%{[agent.version]}-%{+yyyy.MM.dd}"
' s: ?% r, u: H3 O8 B when.contains:
6 B4 M0 W$ G; Y3 H tags: "kuryr-controller"
! h. A3 k! ?7 O' [, b9 Y; v# u7 W% w* v( t
- index: "controller_keystone-error-%{[agent.version]}-%{+yyyy.MM.dd}"
7 X8 Y$ U' c' X- \ when:
) @/ \. S- b. w or:
- _# n& e3 @% R - contains:
0 C7 X: ]6 ]8 @ tags: "keystone"
; Q! _: k1 Y$ O9 C5 D8 [( i" K message: "err"
1 `) Z5 n9 d8 U5 }7 z - contains:
1 d/ Q" ], ]: d7 ]. L4 F tags: "keystone"& G$ k8 L' I& l# A, J1 P, R
message: "ERR"
4 H5 z5 p5 W! e; M+ a" O* I5 y - contains:' a$ T6 ]/ L- n( v
tags: "keystone"
2 j/ d2 l# X" p8 D+ J) x, k( P. E$ U. b message: "fail"; M% c3 ]( C% a7 l% W( Z
- index: "controller_keystone-%{[agent.version]}-%{+yyyy.MM.dd}"% b/ }( p' `) Q! E
when.contains:5 h4 k! ]" b. m: M8 O
tags: "keystone"
* a1 l% O- Z. C$ U' g) {6 v" L7 f9 }% |
setup.ilm.enabled: false3 h4 H! ?; @8 |0 q% C* U2 B1 j! g; y
setup.template.name: system0 ~$ w$ C. O" e0 S5 `( @
setup.template.pattern: system-*! l, O' \$ O. Q
( x2 M! b/ A" {' d9 c' |You have new mail in /var/spool/mail/root B$ y0 K9 ]" ]# }
) P5 X) h6 o+ g d) J8 C! S
* s8 [% a" {. r+ K |
|
发表于 2024-10-31 17:23:37