[英]Logstash is not converting correctly in JSON
以下是我的json日志文件
[
{
"error_message": " Failed to get line from input file (end of file?).",
"type": "ERROR",
"line_no": "2625",
"file": "GTFplainText.c",
"time": "17:40:02",
"date": "01/07/16",
"error_code": "GTF-00014"
},
{
"error_message": " Bad GTF plain text file header or footer line. ",
"type": "ERROR",
"line_no": "2669",
"file": "GTFplainText.c",
"time": "17:40:02",
"date": "01/07/16",
"error_code": "GTF-00004"
},
{
"error_message": " '???' ",
"type": "ERROR",
"line_no": "2670",
"file": "GTFplainText.c",
"time": "17:40:02",
"date": "01/07/16",
"error_code": "GTF-00005"
},
{
"error_message": " Failed to find 'event source'/'product detail' records for event source '3025188506' host event type 1 valid",
"type": "ERROR",
"line_no": "0671",
"file": "RGUIDE.cc",
"time": "15:43:48",
"date": "06/07/16",
"error_code": "RGUIDE-00033"
}
]
根据我的理解,由于日志已经在json中,因此我们在logstash配置中不需要filter部分。 以下是我的logstash配置
input {
file{
path => "/home/ishan/sf_shared/log_json.json"
start_position => "beginning"
codec => "json"
}
}
并且输出配置是
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
stdout { codec => rubydebug }
}
但是似乎数据没有进入ES,因为查询索引时我看不到数据。 我想念什么?
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.