如何配置FileBeat将Apache2日志输出为单行JSON格式？

Got it, let's get your single-line JSON output working. The main issue with your current config is that the codec.json setting isn't properly nested under the output.file section. FileBeat applies codecs per-output, so you need to place the codec inside the output.file block for it to take effect.

Here's the corrected configuration that will produce compact, single-line JSON entries:

output.file:
  path: "/tmp/logstojson/apache2/"
  filename: filebeat
  permissions: 0600
  codec.json:
    pretty: false

Why your original setup didn't work #

In your initial config, codec.json was a top-level key instead of being part of the output.file configuration. This meant FileBeat ignored that codec setting for the file output, falling back to its default formatting (even though you set pretty: false, it wasn't applied to the right output target).

Quick checks to confirm it works: #

• Restart FileBeat: After updating the config, restart the service to apply changes. On most Linux systems, run: sudo systemctl restart filebeat.
• Validate the output: Open the generated file at /tmp/logstojson/apache2/filebeat—each log entry should now be a single line of JSON.
• Check for module conflicts: If you're using the official Apache2 module, ensure it's not adding any extra formatting that might interfere. The module's log parsing will still work seamlessly with this single-line JSON setup.

Once you use this corrected config, each Apache2 log will be output as a single, parseable JSON object per line—perfect for splitting and processing the file later.

内容的提问来源于stack exchange，提问作者AGNEL NANDAPURAPU