Filebeat 启动关闭流程

启动阶段：

instance/beat.go #打印home路径、配置路径、数据路径和日志路径

seccomp #Syscall filter检查

instance/beat.go #beat info

instance/beat.go #build info

instance/beat.go #Go runtime info

instance/beat.go #Host info

instance/beat.go #Process info

instance/beat.go #Setup Beat info

pipeline/consumer.go #开始pipeline event consumer

pipeline/module.go

log/log #每30s开始metrics

instance/beat.go #filebeat开始运行

registrar/registrar.go 加载registrar数据

crawler/crawler.go #加载输入

log/input.go:138 #配置路径

input/input.go:114 #开始input类型

crawler/crawler.go:106 加载并开始输入

cfgfile/reload.go:150 配置重载开始

log/harvester.go:254 开始对目标文件进行收割

pipeline/processor.go:308       Publish event:{

"@timestamp": "2019-02-15T08:11:11.705Z",
"@metadata": {
"beat": "filebeat",
"type": "doc",
"version": "6.5.4"
},
"beat": {
"name": "host-10-191-51-5",
"hostname": "host-10-191-51-5",
"version": "6.5.4"
},
"host": {
"name": "host-10-191-51-5"
},
"source": "/root/testlog/test1.log",
"offset": 0,
"message": "{1}{one}",
"prospector": {
"type": "log"
},
"input": {
"type": "log"
},
"apache": true
}

。。。。。。。。。。。。。。。。。。。。。。。

与kafka连接阶段：

pipeline/output.go:95   Connecting to kafka(10.193.1.127:19092)

kafka/log.go:53 kafka message: Initializing new client

kafka/log.go:53 client/metadata fetching metadata for all topics from broker 10.193.1.127:19092

kafka/log.go:53 Connected to broker at 10.193.1.127:19092 (unregistered)

kafka/log.go:53 client/brokers registered new broker #2 at 10.193.1.138:19092

kafka/log.go:53 client/brokers registered new broker #1 at 10.193.1.127:19092

kafka/log.go:53 client/brokers registered new broker #3 at 10.193.1.153:19092

kafka/log.go:53 kafka message: Successfully initialized new client

pipeline/output.go:105  Connection to kafka(10.193.1.127:19092) established

kafka/log.go:53 producer/broker/2 starting up

kafka/log.go:53 producer/broker/2 state change to [open] on dbank-zuul002/0

kafka/log.go:53 Connected to broker at 10.193.1.138:19092 (registered as #2)

。。。。。。。。。。。。。。。。。。。。。。。

关闭阶段：

beater/filebeat.go:449  Stopping filebeat

crawler/crawler.go:139  Stopping Crawler

cfgfile/reload.go:208   Dynamic config reloader stopped

input/input.go:149      input ticker stopped

log/harvester.go:275    Reader was closed: /root/testlog/test1.log. Closing.

[publish]       pipeline/client.go:148  client: closing acker

[publish]       pipeline/client.go:150  client: done closing acker

[publish]       pipeline/client.go:154  client: cancelled 0 events

crawler/crawler.go:165  Crawler stopped

registrar/registrar.go:356      Stopping Registrar

registrar/registrar.go:282      Ending Registrar

[monitoring]    log/log.go:152  Total non-zero metrics

instance/beat.go:410    filebeat stopped.