From f9b8114d2657d68347c494870d9495bc2643341b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Wed, 7 Nov 2018 13:31:26 +0100 Subject: [PATCH 01/11] refactoring of option "seek" --- journalbeat/config/config.go | 53 ++++++++++++++++++++++++++++++----- journalbeat/input/config.go | 22 ++------------- journalbeat/reader/config.go | 8 ++++-- journalbeat/reader/journal.go | 10 +++++-- 4 files changed, 62 insertions(+), 31 deletions(-) diff --git a/journalbeat/config/config.go b/journalbeat/config/config.go index a2c5b69d951..d0c7edac1f4 100644 --- a/journalbeat/config/config.go +++ b/journalbeat/config/config.go @@ -21,25 +21,64 @@ package config import ( + "fmt" "time" "github.com/elastic/beats/libbeat/common" ) +// SeekMode is specifies how a journal is read +type SeekMode uint8 + // Config stores the configuration of Journalbeat type Config struct { Inputs []*common.Config `config:"inputs"` RegistryFile string `config:"registry_file"` Backoff time.Duration `config:"backoff" validate:"min=0,nonzero"` MaxBackoff time.Duration `config:"max_backoff" validate:"min=0,nonzero"` - Seek string `config:"seek"` + Seek SeekMode `config:"seek"` Matches []string `config:"include_matches"` } -// DefaultConfig are the defaults of a Journalbeat instance -var DefaultConfig = Config{ - RegistryFile: "registry", - Backoff: 1 * time.Second, - MaxBackoff: 60 * time.Second, - Seek: "cursor", +const ( + // SeekInvalid is an invalid value for seek + SeekInvalid SeekMode = iota + // SeekHead option seeks to the head of a journal + SeekHead + // SeekHead option seeks to the tail of a journal + SeekTail + // SeekHead option seeks to the position specified in the cursor + SeekCursor + + seekHeadStr = "head" + seekTailStr = "tail" + seekCursorStr = "cursor" +) + +var ( + // DefaultConfig are the defaults of a Journalbeat instance + DefaultConfig = Config{ + RegistryFile: "registry", + Backoff: 1 * time.Second, + MaxBackoff: 60 * time.Second, + Seek: SeekCursor, + } + + seekModes = map[string]SeekMode{ + seekHeadStr: SeekHead, + seekTailStr: SeekTail, + seekCursorStr: SeekCursor, + } +) + +// Unpack validates and unpack "seek" config option +func (m *SeekMode) Unpack(value string) error { + mode, ok := seekModes[value] + if !ok { + return fmt.Errorf("invalid seek mode '%s'", value) + } + + *m = mode + + return nil } diff --git a/journalbeat/input/config.go b/journalbeat/input/config.go index 6383998bd1b..04be530e1fa 100644 --- a/journalbeat/input/config.go +++ b/journalbeat/input/config.go @@ -18,9 +18,9 @@ package input import ( - "fmt" "time" + "github.com/elastic/beats/journalbeat/config" "github.com/elastic/beats/libbeat/common" "github.com/elastic/beats/libbeat/processors" ) @@ -37,7 +37,7 @@ type Config struct { // BackoffFactor is the multiplier of Backoff. MaxBackoff time.Duration `config:"max_backoff" validate:"min=0,nonzero"` // Seek is the method to read from journals. - Seek string `config:"seek"` + Seek config.SeekMode `config:"seek"` // Matches store the key value pairs to match entries. Matches []string `config:"include_matches"` @@ -53,22 +53,6 @@ var ( Backoff: 1 * time.Second, BackoffFactor: 2, MaxBackoff: 60 * time.Second, - Seek: "cursor", + Seek: config.SeekCursor, } ) - -// Validate check the configuration of the input. -func (c *Config) Validate() error { - correctSeek := false - for _, s := range []string{"cursor", "head", "tail"} { - if c.Seek == s { - correctSeek = true - } - } - - if !correctSeek { - return fmt.Errorf("incorrect value for seek: %s. possible values: cursor, head, tail", c.Seek) - } - - return nil -} diff --git a/journalbeat/reader/config.go b/journalbeat/reader/config.go index b81005ec926..7d52ff7422d 100644 --- a/journalbeat/reader/config.go +++ b/journalbeat/reader/config.go @@ -17,7 +17,11 @@ package reader -import "time" +import ( + "time" + + "github.com/elastic/beats/journalbeat/config" +) // Config stores the options of a reder. type Config struct { @@ -25,7 +29,7 @@ type Config struct { Path string // Seek specifies the seeking stategy. // Possible values: head, tail, cursor. - Seek string + Seek config.SeekMode // MaxBackoff is the limit of the backoff time. MaxBackoff time.Duration // Backoff is the current interval to wait before diff --git a/journalbeat/reader/journal.go b/journalbeat/reader/journal.go index f7afc30a4d0..f2bc5ef3fa9 100644 --- a/journalbeat/reader/journal.go +++ b/journalbeat/reader/journal.go @@ -32,6 +32,7 @@ import ( "github.com/elastic/beats/journalbeat/checkpoint" "github.com/elastic/beats/journalbeat/cmd/instance" + "github.com/elastic/beats/journalbeat/config" "github.com/elastic/beats/libbeat/beat" "github.com/elastic/beats/libbeat/common" "github.com/elastic/beats/libbeat/logp" @@ -142,7 +143,8 @@ func setupMatches(j *sdjournal.Journal, matches []string) error { // seek seeks to the position determined by the coniguration and cursor state. func (r *Reader) seek(cursor string) { - if r.config.Seek == "cursor" { + switch r.config.Seek { + case config.SeekCursor: if cursor == "" { r.journal.SeekHead() r.logger.Debug("Seeking method set to cursor, but no state is saved for reader. Starting to read from the beginning") @@ -154,12 +156,14 @@ func (r *Reader) seek(cursor string) { r.logger.Error("Error while seeking to cursor") } r.logger.Debug("Seeked to position defined in cursor") - } else if r.config.Seek == "tail" { + case config.SeekTail: r.journal.SeekTail() r.logger.Debug("Tailing the journal file") - } else if r.config.Seek == "head" { + case config.SeekHead: r.journal.SeekHead() r.logger.Debug("Reading from the beginning of the journal file") + default: + r.logger.Error("Invalid seeking mode") } } From 8382f0fdc0466290470b24463fb616eadebbd955 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Wed, 7 Nov 2018 13:31:49 +0100 Subject: [PATCH 02/11] rename "custom" field namespace to "journald.custom" --- journalbeat/reader/journal.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/journalbeat/reader/journal.go b/journalbeat/reader/journal.go index f2bc5ef3fa9..54cc59c1bcd 100644 --- a/journalbeat/reader/journal.go +++ b/journalbeat/reader/journal.go @@ -224,7 +224,7 @@ func (r *Reader) toEvent(entry *sdjournal.JournalEntry) *beat.Event { } if len(custom) != 0 { - fields["custom"] = custom + fields.Put("journald.custom", custom) } state := checkpoint.JournalState{ From 0b4c7475dad56ee0af9110ecbf82e695db814664 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Wed, 7 Nov 2018 14:40:34 +0100 Subject: [PATCH 03/11] add dashboard to journalbeat --- .../6/dashboard/Journalbeat-overview.json | 169 ++++++++++++++++++ 1 file changed, 169 insertions(+) create mode 100644 journalbeat/_meta/kibana/6/dashboard/Journalbeat-overview.json diff --git a/journalbeat/_meta/kibana/6/dashboard/Journalbeat-overview.json b/journalbeat/_meta/kibana/6/dashboard/Journalbeat-overview.json new file mode 100644 index 00000000000..fc771e9bebd --- /dev/null +++ b/journalbeat/_meta/kibana/6/dashboard/Journalbeat-overview.json @@ -0,0 +1,169 @@ +{ + "objects": [ + { + "attributes": { + "columns": [ + "@timestamp", + "host.name", + "message" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "highlightAll": true, + "index": "journalbeat-*", + "query": { + "language": "lucene", + "query": "process.name:systemd" + }, + "version": true + } + }, + "sort": [ + "@timestamp", + "desc" + ], + "title": "[Journalbeat] Systemd messages", + "version": 1 + }, + "id": "aa003e90-e2b9-11e8-9f52-734e93de180d", + "type": "search", + "updated_at": "2018-11-07T18:19:28.377Z", + "version": 1 + }, + { + "attributes": { + "columns": [ + "@timestamp", + "host.name", + "journald.kernel.subsystem", + "message" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "highlightAll": true, + "index": "journalbeat-*", + "query": { + "language": "lucene", + "query": "syslog.facility:0 AND syslog.priority:\u003c4" + }, + "version": true + } + }, + "sort": [ + "_score", + "desc" + ], + "title": "[Journalbeat] Kernel errors", + "version": 1 + }, + "id": "5db75310-e2ba-11e8-9f52-734e93de180d", + "type": "search", + "updated_at": "2018-11-07T18:24:29.889Z", + "version": 1 + }, + { + "attributes": { + "columns": [ + "@timestamp", + "host.name", + "process.name", + "message" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "highlightAll": true, + "index": "journalbeat-*", + "query": { + "language": "lucene", + "query": "syslog.facility:4" + }, + "version": true + } + }, + "sort": [ + "_score", + "desc" + ], + "title": "[Journalbeat] Login authorization", + "version": 1 + }, + "id": "82408120-e2ba-11e8-9f52-734e93de180d", + "type": "search", + "updated_at": "2018-11-07T18:26:05.348Z", + "version": 2 + }, + { + "attributes": { + "columns": [ + "@timestamp", + "host.name", + "journald.kernel.subsystem", + "journald.kernel.device_node_path", + "message" + ], + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "highlightAll": true, + "index": "journalbeat-*", + "query": { + "language": "lucene", + "query": "journald.kernel.subsystem:usb OR journald.kernel.subsystem:hid" + }, + "version": true + } + }, + "sort": [ + "_score", + "desc" + ], + "title": "[Journalbeat] USB and HID messages", + "version": 1 + }, + "id": "f0232670-e2ba-11e8-9f52-734e93de180d", + "type": "search", + "updated_at": "2018-11-07T18:28:35.543Z", + "version": 1 + }, + { + "attributes": { + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "lucene", + "query": "" + } + } + }, + "optionsJSON": { + "darkTheme": false, + "hidePanelTitles": false, + "useMargins": true + }, + "panelsJSON": null, + "timeRestore": false, + "title": "[Journalbeat] Overview", + "version": 1 + }, + "id": "f2de4440-e2b9-11e8-9f52-734e93de180d", + "type": "dashboard", + "updated_at": "2018-11-07T18:30:18.083Z", + "version": 2 + } + ], + "version": "7.0.0-alpha1-SNAPSHOT" +} From e6a7c8ea104e807d1cad4fe9d84d3c880beea4a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Wed, 7 Nov 2018 18:32:40 +0100 Subject: [PATCH 04/11] read the newest event --- journalbeat/reader/journal.go | 1 + 1 file changed, 1 insertion(+) diff --git a/journalbeat/reader/journal.go b/journalbeat/reader/journal.go index 54cc59c1bcd..8df68170fcd 100644 --- a/journalbeat/reader/journal.go +++ b/journalbeat/reader/journal.go @@ -158,6 +158,7 @@ func (r *Reader) seek(cursor string) { r.logger.Debug("Seeked to position defined in cursor") case config.SeekTail: r.journal.SeekTail() + r.journal.Next() r.logger.Debug("Tailing the journal file") case config.SeekHead: r.journal.SeekHead() From bd51b39d7ca474f5060ae01de54ce19f6b188976 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Wed, 7 Nov 2018 18:35:22 +0100 Subject: [PATCH 05/11] do not get stuck in client.Publish --- journalbeat/input/input.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/journalbeat/input/input.go b/journalbeat/input/input.go index 42d8a0ea394..6e49c782a7d 100644 --- a/journalbeat/input/input.go +++ b/journalbeat/input/input.go @@ -135,7 +135,11 @@ func (i *Input) Run() { } defer client.Close() - i.publishAll(client) + go i.publishAll(client) + + select { + case <-i.done: + } } // publishAll reads events from all readers and publishes them. From 67ad29af724e9e397f4871066ca79edc75bba23c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Wed, 7 Nov 2018 19:52:32 +0100 Subject: [PATCH 06/11] feed the hound --- journalbeat/config/config.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/journalbeat/config/config.go b/journalbeat/config/config.go index d0c7edac1f4..b2faa3b73b9 100644 --- a/journalbeat/config/config.go +++ b/journalbeat/config/config.go @@ -45,9 +45,9 @@ const ( SeekInvalid SeekMode = iota // SeekHead option seeks to the head of a journal SeekHead - // SeekHead option seeks to the tail of a journal + // SeekTail option seeks to the tail of a journal SeekTail - // SeekHead option seeks to the position specified in the cursor + // SeekCursor option seeks to the position specified in the cursor SeekCursor seekHeadStr = "head" From b0130fe5a6ea65be1a9017e7b3657d2b3e675692 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Wed, 7 Nov 2018 20:38:45 +0100 Subject: [PATCH 07/11] close client of input in `Stop` --- journalbeat/input/input.go | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/journalbeat/input/input.go b/journalbeat/input/input.go index 6e49c782a7d..094d169a4ca 100644 --- a/journalbeat/input/input.go +++ b/journalbeat/input/input.go @@ -37,6 +37,7 @@ type Input struct { done chan struct{} config Config pipeline beat.Pipeline + client beat.Client states map[string]checkpoint.JournalState id uuid.UUID logger *logp.Logger @@ -120,7 +121,8 @@ func New( // Run connects to the output, collects entries from the readers // and then publishes the events. func (i *Input) Run() { - client, err := i.pipeline.ConnectWith(beat.ClientConfig{ + var err error + i.client, err = i.pipeline.ConnectWith(beat.ClientConfig{ PublishMode: beat.GuaranteedSend, EventMetadata: i.eventMeta, Meta: nil, @@ -133,17 +135,12 @@ func (i *Input) Run() { i.logger.Error("Error connecting to output: %v", err) return } - defer client.Close() - go i.publishAll(client) - - select { - case <-i.done: - } + i.publishAll() } // publishAll reads events from all readers and publishes them. -func (i *Input) publishAll(client beat.Client) { +func (i *Input) publishAll() { out := make(chan *beat.Event) defer close(out) @@ -183,13 +180,14 @@ func (i *Input) publishAll(client beat.Client) { case <-i.done: return case e := <-out: - client.Publish(*e) + i.client.Publish(*e) } } } // Stop stops all readers of the input. func (i *Input) Stop() { + i.client.Close() for _, r := range i.readers { r.Close() } From 241d6d61ed78bbcdea3645b88b4fbb6f5f3c5f1c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Thu, 8 Nov 2018 09:46:46 +0100 Subject: [PATCH 08/11] followup in unit test --- journalbeat/reader/journal_test.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/journalbeat/reader/journal_test.go b/journalbeat/reader/journal_test.go index 5170afd2593..8c37026f8ba 100644 --- a/journalbeat/reader/journal_test.go +++ b/journalbeat/reader/journal_test.go @@ -65,8 +65,10 @@ func TestToEvent(t *testing.T) { }, }, expectedFields: common.MapStr{ - "custom": common.MapStr{ - "my_custom_field": "value", + "journald": common.MapStr{ + "custom": common.MapStr{ + "my_custom_field": "value", + }, }, }, }, From dbf07ceec0e4572c1fa07c70524f4dd609ab0f28 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Thu, 8 Nov 2018 11:41:07 +0100 Subject: [PATCH 09/11] put registry file under folder specified in `path.data` --- journalbeat/checkpoint/checkpoint.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/journalbeat/checkpoint/checkpoint.go b/journalbeat/checkpoint/checkpoint.go index f2c3bfacdab..0f29861040b 100644 --- a/journalbeat/checkpoint/checkpoint.go +++ b/journalbeat/checkpoint/checkpoint.go @@ -32,6 +32,7 @@ import ( "gopkg.in/yaml.v2" "github.com/elastic/beats/libbeat/logp" + "github.com/elastic/beats/libbeat/paths" ) // Checkpoint persists event log state information to disk. @@ -87,6 +88,8 @@ func NewCheckpoint(file string, maxUpdates int, interval time.Duration) (*Checkp save: make(chan JournalState, 1), } + c.file = paths.Resolve(paths.Data, c.file) + // Minimum batch size. if c.maxUpdates < 1 { c.maxUpdates = 1 From 3a9a0c754ccdaac09ccf49568077c684e543c0a7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Thu, 8 Nov 2018 12:33:08 +0100 Subject: [PATCH 10/11] rm backoff, seek and include_matches from global options --- journalbeat/_meta/beat.yml | 12 ------------ journalbeat/config/config.go | 8 -------- journalbeat/journalbeat.reference.yml | 12 ------------ journalbeat/journalbeat.yml | 12 ------------ 4 files changed, 44 deletions(-) diff --git a/journalbeat/_meta/beat.yml b/journalbeat/_meta/beat.yml index c4e3c14db56..903abe0fff3 100644 --- a/journalbeat/_meta/beat.yml +++ b/journalbeat/_meta/beat.yml @@ -42,15 +42,3 @@ journalbeat.inputs: # Name of the registry file. If a relative path is used, it is considered relative to the # data path. #registry_file: registry - - # The number of seconds to wait before trying to read again from journals. - #backoff: 1s - # The maximum number of seconds to wait before attempting to read again from journals. - #max_backoff: 60s - - # Position to start reading from all journal. Possible values: head, tail, cursor - #seek: head - - # Exact matching for field values of events. - # Matching for nginx entries: "systemd.unit=nginx" - #matches: [] diff --git a/journalbeat/config/config.go b/journalbeat/config/config.go index b2faa3b73b9..395bf13ec9c 100644 --- a/journalbeat/config/config.go +++ b/journalbeat/config/config.go @@ -22,7 +22,6 @@ package config import ( "fmt" - "time" "github.com/elastic/beats/libbeat/common" ) @@ -34,10 +33,6 @@ type SeekMode uint8 type Config struct { Inputs []*common.Config `config:"inputs"` RegistryFile string `config:"registry_file"` - Backoff time.Duration `config:"backoff" validate:"min=0,nonzero"` - MaxBackoff time.Duration `config:"max_backoff" validate:"min=0,nonzero"` - Seek SeekMode `config:"seek"` - Matches []string `config:"include_matches"` } const ( @@ -59,9 +54,6 @@ var ( // DefaultConfig are the defaults of a Journalbeat instance DefaultConfig = Config{ RegistryFile: "registry", - Backoff: 1 * time.Second, - MaxBackoff: 60 * time.Second, - Seek: SeekCursor, } seekModes = map[string]SeekMode{ diff --git a/journalbeat/journalbeat.reference.yml b/journalbeat/journalbeat.reference.yml index 39119ab8fa2..e823f2c72cb 100644 --- a/journalbeat/journalbeat.reference.yml +++ b/journalbeat/journalbeat.reference.yml @@ -43,18 +43,6 @@ journalbeat.inputs: # data path. #registry_file: registry - # The number of seconds to wait before trying to read again from journals. - #backoff: 1s - # The maximum number of seconds to wait before attempting to read again from journals. - #max_backoff: 60s - - # Position to start reading from all journal. Possible values: head, tail, cursor - #seek: head - - # Exact matching for field values of events. - # Matching for nginx entries: "systemd.unit=nginx" - #matches: [] - #================================ General ====================================== # The name of the shipper that publishes the network data. It can be used to group diff --git a/journalbeat/journalbeat.yml b/journalbeat/journalbeat.yml index 753c6ef4f8f..8edc5b63ae5 100644 --- a/journalbeat/journalbeat.yml +++ b/journalbeat/journalbeat.yml @@ -43,18 +43,6 @@ journalbeat.inputs: # data path. #registry_file: registry - # The number of seconds to wait before trying to read again from journals. - #backoff: 1s - # The maximum number of seconds to wait before attempting to read again from journals. - #max_backoff: 60s - - # Position to start reading from all journal. Possible values: head, tail, cursor - #seek: head - - # Exact matching for field values of events. - # Matching for nginx entries: "systemd.unit=nginx" - #matches: [] - #================================ General ===================================== # The name of the shipper that publishes the network data. It can be used to group From 209ceff589a44600a02162496b0bd20403736053 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Thu, 8 Nov 2018 12:33:45 +0100 Subject: [PATCH 11/11] decrease max_backoff to 20 seconds --- journalbeat/_meta/beat.yml | 2 +- journalbeat/input/config.go | 13 +++++-------- journalbeat/journalbeat.reference.yml | 2 +- journalbeat/journalbeat.yml | 2 +- 4 files changed, 8 insertions(+), 11 deletions(-) diff --git a/journalbeat/_meta/beat.yml b/journalbeat/_meta/beat.yml index 903abe0fff3..78c28ffe36d 100644 --- a/journalbeat/_meta/beat.yml +++ b/journalbeat/_meta/beat.yml @@ -21,7 +21,7 @@ journalbeat.inputs: # The number of seconds to wait before trying to read again from journals. #backoff: 1s # The maximum number of seconds to wait before attempting to read again from journals. - #max_backoff: 60s + #max_backoff: 20s # Position to start reading from journal. Valid values: head, tail, cursor seek: cursor diff --git a/journalbeat/input/config.go b/journalbeat/input/config.go index 04be530e1fa..5bdbfcd2ec9 100644 --- a/journalbeat/input/config.go +++ b/journalbeat/input/config.go @@ -29,12 +29,10 @@ import ( type Config struct { // Paths stores the paths to the journal files to be read. Paths []string `config:"paths"` - // MaxBackoff is the limit of the backoff time. - Backoff time.Duration `config:"backoff" validate:"min=0,nonzero"` // Backoff is the current interval to wait before // attemting to read again from the journal. - BackoffFactor int `config:"backoff_factor" validate:"min=1"` - // BackoffFactor is the multiplier of Backoff. + Backoff time.Duration `config:"backoff" validate:"min=0,nonzero"` + // MaxBackoff is the limit of the backoff time. MaxBackoff time.Duration `config:"max_backoff" validate:"min=0,nonzero"` // Seek is the method to read from journals. Seek config.SeekMode `config:"seek"` @@ -50,9 +48,8 @@ type Config struct { var ( // DefaultConfig is the defaults for an inputs DefaultConfig = Config{ - Backoff: 1 * time.Second, - BackoffFactor: 2, - MaxBackoff: 60 * time.Second, - Seek: config.SeekCursor, + Backoff: 1 * time.Second, + MaxBackoff: 20 * time.Second, + Seek: config.SeekCursor, } ) diff --git a/journalbeat/journalbeat.reference.yml b/journalbeat/journalbeat.reference.yml index e823f2c72cb..59b6d2d813c 100644 --- a/journalbeat/journalbeat.reference.yml +++ b/journalbeat/journalbeat.reference.yml @@ -21,7 +21,7 @@ journalbeat.inputs: # The number of seconds to wait before trying to read again from journals. #backoff: 1s # The maximum number of seconds to wait before attempting to read again from journals. - #max_backoff: 60s + #max_backoff: 20s # Position to start reading from journal. Valid values: head, tail, cursor seek: cursor diff --git a/journalbeat/journalbeat.yml b/journalbeat/journalbeat.yml index 8edc5b63ae5..b2ab42fb81b 100644 --- a/journalbeat/journalbeat.yml +++ b/journalbeat/journalbeat.yml @@ -21,7 +21,7 @@ journalbeat.inputs: # The number of seconds to wait before trying to read again from journals. #backoff: 1s # The maximum number of seconds to wait before attempting to read again from journals. - #max_backoff: 60s + #max_backoff: 20s # Position to start reading from journal. Valid values: head, tail, cursor seek: cursor