<div id="readability-page-1" class="page"><div id="post-body-1446608482965908543" itemprop="articleBody">
audit.log 연동.<div>filebeat.inputs:- type: filestreamid: my-filestream-idenabled: truepaths:- d:\test.logoutput.console:pretty: trueprocessors:- include_fields:fields: "message"</div><a name="more"></a>실행은 됐는데 데이터를 가져오지 못한다.<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoR7SEyH4u7OPnhrrKh1rBTVuUUtHkEG7s_EjBsQnFrzD9rsxkuADdbIUyo2HhM_K9rh-7Itm-5uNlOXOKt8sR1FOVj3v2quJrhCOjnJPlBZH8e0gewX-ebsOLFJLkaNmagwMIuYLb4LDDkZu4c0Ud7DkusroAA_0V-pUhU8-rjgktGWgwX5CpUHGDv5AW/s1280/filebeat_log.png"><img data-original-height="720" data-original-width="1280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoR7SEyH4u7OPnhrrKh1rBTVuUUtHkEG7s_EjBsQnFrzD9rsxkuADdbIUyo2HhM_K9rh-7Itm-5uNlOXOKt8sR1FOVj3v2quJrhCOjnJPlBZH8e0gewX-ebsOLFJLkaNmagwMIuYLb4LDDkZu4c0Ud7DkusroAA_0V-pUhU8-rjgktGWgwX5CpUHGDv5AW/s16000/filebeat_log.png"></a><a href="https://www.elastic.co/docs/reference/beats/filebeat/command-line-options#global-flags" target="_blank">디버그 모드</a>(filebeat.exe -e -d "*") 실행.<div><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFJCvQ5RJUkY-qJumLvUwq8Fvv4Vf3NF-G-Cft3TyqNRx5WaW-BViWwVcGxXk5n6fZ5zZ-k9OucuqUsmxJF3zAC3LXY-Z-arG-2fhHOwX2KAQ3irZ5vB6kd6ELJDOsmRtrB_NPuhvxbAR26Jf9S-UCi4KbOtfepnIsXZBDhzy5rpIWPmUTgAULbk1HDa0N/s1280/filebeat_debug.png"><img data-original-height="720" data-original-width="1280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFJCvQ5RJUkY-qJumLvUwq8Fvv4Vf3NF-G-Cft3TyqNRx5WaW-BViWwVcGxXk5n6fZ5zZ-k9OucuqUsmxJF3zAC3LXY-Z-arG-2fhHOwX2KAQ3irZ5vB6kd6ELJDOsmRtrB_NPuhvxbAR26Jf9S-UCi4KbOtfepnIsXZBDhzy5rpIWPmUTgAULbk1HDa0N/s16000/filebeat_debug.png"></a>파일 사이즈가 너무 작다고? 8.18까지 잘 되던 게 안 되는 거 보니 9.0에서 변화가 있는 모양. 릴리즈 노트를 살펴보니 파일 수집 방식이 변경됐다. <a href="https://www.elastic.co/docs/release-notes/beats/breaking-changes" target="_blank">1MB 이상일 때만 수집 가능</a>하다고.</div><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVoS-b3Qfa8YDGw-DVmaXSA8uh3v4vwvYwlcN6J1oW_XLTpdkQIP3-ELipMu404etZ9WgygimY8oehq9GYwWklZc2rdJu23vVktHv6O06c1PIH08cOjYaZeiihpnrd6obo3U7YWQDVKtp6mHeEQ5uZhbdLm2z3lFLNQC0xmb0r66B31ctuyNHr6uwUgDU6/s1280/beat9_release.png"><img data-original-height="676" data-original-width="1280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVoS-b3Qfa8YDGw-DVmaXSA8uh3v4vwvYwlcN6J1oW_XLTpdkQIP3-ELipMu404etZ9WgygimY8oehq9GYwWklZc2rdJu23vVktHv6O06c1PIH08cOjYaZeiihpnrd6obo3U7YWQDVKtp6mHeEQ5uZhbdLm2z3lFLNQC0xmb0r66B31ctuyNHr6uwUgDU6/s16000/beat9_release.png"></a>설정 변경.<div>filebeat.inputs:- type: filestreamid: my-filestream-idenabled: truepaths:- d:\test.logprospector.scanner.fingerprint.enabled: falseoutput.console:pretty: trueprocessors:- include_fields:fields: "message"</div>
<div><pre><code><div>{&nbsp; "@timestamp": "2025-05-02T03:41:27.182Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "9.0.0"&nbsp; },&nbsp; "message": "type=NETFILTER_CFG msg=audit(1745768855.270:63): table=filter family=10 entries=0"}{&nbsp; "@timestamp": "2025-05-02T03:41:27.182Z",&nbsp; "@metadata": {&nbsp; &nbsp; "beat": "filebeat",&nbsp; &nbsp; "type": "_doc",&nbsp; &nbsp; "version": "9.0.0"&nbsp; },&nbsp; "message": "type=SYSCALL msg=audit(1745768855.720:63): arch=c000003e syscall=175 success=yes exit=0 a0=1e2da20 a1=1d75 a2=41a2d8 a3=1e2a500 items=0 ppid=1335 pid=1336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"modprobe\" exe=\"/usr/bin/kmod\" subj=system_u:system_r:insmod_t:s0 key=(null)"}</div></code></pre></div>
<div>관련 글<div><ul><li><a href="https://kangmyounghun.blogspot.com/2025/04/elasticsearch-90.html">Elasticsearch 9.0의 변화</a></li><li><a href="https://kangmyounghun.blogspot.com/2025/05/beat-processors-7th.html">Beat processors - 7th</a></li></ul></div></div>

</div></div>

케세라세라

audit.log 연동.
filebeat.inputs:
- type: filestream
  id: my-filestream-id
  enabled: true
  paths:
    - d:\test.log
output.console:
  pretty: true
processors:
  - include_fields:
      fields: "message"
실행은 됐는데 데이터를 가져오지 못한다.
디버그 모드(filebeat.exe -e -d "*") 실행.
파일 사이즈가 너무 작다고? 8.18까지 잘 되던 게 안 되는 거 보니 9.0에서 변화가 있는 모양. 릴리즈 노트를 살펴보니 파일 수집 방식이 변경됐다. 1MB 이상일 때만 수집 가능하다고.
설정 변경.
filebeat.inputs:
- type: filestream
  id: my-filestream-id
  enabled: true
  paths:
    - d:\test.log
  prospector.scanner.fingerprint.enabled: false
output.console:
  pretty: true
processors:
  - include_fields:
      fields: "message"
{
  "@timestamp": "2025-05-02T03:41:27.182Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.0.0"
  },
  "message": "type=NETFILTER_CFG msg=audit(1745768855.270:63): table=filter family=10 entries=0"
}
{
  "@timestamp": "2025-05-02T03:41:27.182Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.0.0"
  },
  "message": "type=SYSCALL msg=audit(1745768855.720:63): arch=c000003e syscall=175 success=yes exit=0 a0=1e2da20 a1=1d75 a2=41a2d8 a3=1e2a500 items=0 ppid=1335 pid=1336 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"modprobe\" exe=\"/usr/bin/kmod\" subj=system_u:system_r:insmod_t:s0 key=(null)"
}
관련 글
Elasticsearch 9.0의 변화
Beat processors - 7th

Filebeat 9.0의 변화

댓글