如何正确配置 LogStash 以从 RabbitMQ 读取并将 output 写入文件？

Question

我想使用 LogStash 阅读 RabbitMQ 发布的消息，并将响应作为每个文件的一个 JSON 行写入本地文件夹中。

我已经安装了 Docker 桌面并拉取了 LogStash docker 图像。

我创建了一个config文件夹，其中包含以下logstash.conf文件

#logstash.conf
input {
  rabbitmq{
    host => "xxxxx.com"
    port => 5672
    heartbeat => 30
    durable => true
    exchange => "xxxxx"
    exchange_type => "topic"
    user-id => "xxxx"
    password => "xxxx"
    key => "#xxxx#"
    queue => "xxxxx"}}


   output{
     file {
       path => "C:/logtest"}
     }
   }

I then in Windows CMD write docker run --rm -it -v C:/logstashconfig/ docker.elastic.co/logstash/logstash:6.0.1

但我得到错误。

Unable to retrieve license information from license server {:message=>"No Available connections", :class=>"LogStash::Outputs::ElasticSearch::HttpClient::Pool::NoConnectionAvailableError"}

和警告。

Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://logstash_system:xxxxxx@elasticsearch:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://logstash_system:xxxxxx@elasticsearch:9200/][Manticore::ResolutionFailure] elasticsearch: Name or service not known"}

那么我是否还安装了其他东西，比如 ElasticSearch？ 还是我必须更改配置文件中的某些内容才能使其正常工作？

Answer 1

It seems you are trying to send monitoring information to an elasticsearch server which is identified as elasticsearch:9200 in logstash.yml, or you might have a pipeline that has a elasticsearch output. 禁用它或更正主机以指向真正的 elasticsearch 服务器。