[英]logstash-input-heroku running as a service on ubuntu (logstash 5.2.1)
我正在尝试使用systemd在运行ubuntu 16.04的aws ec2实例上运行logstash。 我已经在机器上安装了heroku工具带。 正常运行管道(通过bin / logstash.bat)可以正常工作,并且可以提取事件(但是,几分钟后,出现“请求超时”错误,管道停止,这是一个单独的问题)。
但是,当我尝试在systemd上运行服务时出现错误,不确定两种错误是否相关。 第一个是SSL错误:
错误:无密码匹配(OpenSSL :: SSL :: SSLError)
[2017-02-15T13:08:44,037] [错误] [logstash.pipeline]插件发生不可恢复的错误。 将重新启动此插件。 插件:“ xxxxxx”,编解码器=>“ ^%{TIMESTAMP_ISO8601}%{WORD} \\ [\\ w +(\\。\\ d +)?\\]:(\\ s {3,} | \\}}”,what =>“以前的“,id =>” 032c3b317ae49982945ec7e8fbf11224be98f237-3“,enable_metric => true,negate => false,charset =>” UTF-8“,multiline_tag =>” multiline“,max_lines => 500,max_bytes => 10485760>,id =>“ 032c3b317ae49982945ec7e8fbf11224be98f237-4”,enable_metric => true>
第二个是heroku工具区似乎正在提示输入凭据:
2月15日13:08:43 ip-10-0-1-216 logstash [4402]:输入您的Heroku凭据。
2月15日13:08:43 ip-10-0-1-216 logstash [4402]:电子邮件:密码(输入将被隐藏):
我的logstash配置:
input {
heroku {
app => "xxx-1"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601} %{WORD}\[\w+(\.\d+)?\]:(\s{3,}| \})"
what => "previous"
}
}
heroku {
app => "xxx-2"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601} %{WORD}\[\w+(\.\d+)?\]:(\s{3,}| \})"
what => "previous"
}
}
heroku {
app => "xxx-3"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601} %{WORD}\[\w+(\.\d+)?\]:(\s{3,}| \})"
what => "previous"
}
}
heroku {
app => "xxx-4"
codec => multiline {
pattern => "^%{TIMESTAMP_ISO8601} %{WORD}\[\w+(\.\d+)?\]:(\s{3,}| \})"
what => "previous"
}
}
}
filter {
grok {
break_on_match => true
patterns_dir => ["./grok_patterns"]
match => { "message" => [
"^%{TIMESTAMP_ISO8601:timestamp} %{WORD:heroku_source}\[%{DYNO:dyno}\]: %{LEVEL:level}: HTTP %{OPT_NOT_SPACE_COMMA:organization}, %{OPT_NOT_COMMA:user}, %{OPT_NOT_COMMA:device}, %{WORD:method} %{ENDPOINT:endpoint}%{QUERY:query} \[%{INT:responseCode:int}\].*? \(p%{INT:nodeProcess:int}\) \(%{INT:responseTime:int}ms\).*$",
"^%{TIMESTAMP_ISO8601:timestamp} %{WORD:heroku}\[%{WORD:component}\]: at=\w+ method=%{WORD:method} path=\"%{ENDPOINT:endpoint}\??%{QUERY:query}\" .*?fwd=\"%{IP:site_ip}\" dyno=%{DYNO:dyno} .*?service=%{INT:responseTime:int}ms status=%{INT:responseCode:int} bytes=%{INT:sizeBytes:int}.*?$",
"^%{TIMESTAMP_ISO8601:timestamp} %{WORD:heroku_source}\[%{DYNO:dyno}\]: (?<data>.*)"
] }
add_field => { "endpoint_template" => "%{endpoint}" }
}
mutate {
gsub => ["endpoint_template", "[0-9a-f]{24}", "ID"]
add_field => { "type" => "heroku" }
}
if ![heroku_source] {
geoip {
source => "site_ip"
}
mutate {
add_field => { "heroku_source" => "heroku" }
}
}
}
output {
elasticsearch {
hosts => [ "aws-es-endpoint:443" ]
ssl => true
}
}
(我敢肯定它会得到改善)
我尝试以根用户身份运行服务,但结果是相同的。 为了澄清,这有效:
/usr/share/logstash/bin/logstash --path.settings /etc/logstash/
虽然这不是:
sudo systemctl start logstash
这是按弹性安装程序的干净安装Logstash 5.2.1。 Systemd也根据其过程运行,因此它执行与我手动执行的命令相同的命令。 cat logstash.service
输出:
[Unit]
Description=logstash
[Service]
Type=simple
User=logstash
Group=logstash
# Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.
# Prefixing the path with '-' makes it try to load, but if the file doesn't
# exist, it continues onward.
EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=16384
[Install]
WantedBy=multi-user.target
(当我注释掉上面的用户和组时,结果是相同的)
仅作记录,结果是问题出在systemd没有看到heroku凭证。 我在AskUbuntu上问了类似的问题 。 解决方案是将ubuntu主目录添加到logstash服务中,以便它可以访问凭据。 通过在/ etc / systemd / system中编辑logstash.service
文件并在其中设置Environment="Home=/home/ubuntu"
。
最终的logstash.service文件的示例:
[Unit]
Description=logstash
[Service]
Type=simple
User=logstash
Group=root
# Load env vars from /etc/default/ and /etc/sysconfig/ if they exist.
# Prefixing the path with '-' makes it try to load, but if the file doesn't
# exist, it continues onward.
Environment="HOME=/home/ubuntu"
EnvironmentFile=-/etc/default/logstash
EnvironmentFile=-/etc/sysconfig/logstash
ExecStart=/usr/share/logstash/bin/logstash "--path.settings" "/etc/logstash"
Restart=always
WorkingDirectory=/
Nice=19
LimitNOFILE=16384
[Install]
WantedBy=multi-user.target
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.