ArcGIS Enterprise log data
Procedure
-
Configuring Filebeat on the ArcGIS Enterprise Host to poll the log files on a regular basis (see below)
-
Verify ArcGIS Log Level is set correctly (see below)
Filebeat configuration - Notes
The Filebeat component must be installed for each ArcGIS host that is to be involved in collecting the log data. Currently Filebeat 7.x is supported, with Filebeat 8.x no problems could be found yet.
The Filebeat configuration is then done on the basis of the template filebeat/arcgis-logfile/filebeat.yml.
# The value of this option will be added to the "labels.env" field in the index.
arcgis.env: 'production'
# By using this field you can specify the ArcGIS Enterprise source
arcgis.source: 'arcgis-server'
# arcgis.source: 'arcgis-portal'
# arcgis.source: 'arcgis-datastore'
# arcgis.base.path: 'c:\arcgisserver\logs'
arcgis.base.path: ''
filebeat.inputs:
- type: log
# Change to true to enable this input configuration.
enabled: true
# Paths that should be crawled and fetched for ArcGIS Enterprise logs. Glob based paths.
# Adopt these paths/patterns according to your environment
paths:
- ${arcgis.base.path}\*\server\*.log
- ${arcgis.base.path}\*\services\*\*.log
- ${arcgis.base.path}\*\services\*\*\*.log
- ${arcgis.base.path}\*\services\System\*\*.log
fields_under_root: true
fields:
labels:
env: ${arcgis.env}
source: ${arcgis.source}
### Multiline options
# Match can be set to "after" or "before". It is used to define if lines should be append to a pattern
# that was (not) matched before or after or as long as a pattern is not matched based on negate.
#
# Note: This needs only be adopted if the ArcGIS Server Log files structure changes
multiline.pattern: '^<Msg([^>]*?)>(.*)'
multiline.negate: true
multiline.match: after
output.logstash:
hosts: ["logstash.host:5604"]
Select the value under arcgis.source from arcgis-server, arcgis-portal, arcgis-datastore to get better filtering possibilities in Kibana. The same applies to arcgis.env to distinguish between different stages.
|