[英]logstash does not create index
我已經用elasticsearch 1.5.1設置了logstash 1.5.0。 Kibana啟動並通過nginx運行logstash界面。
但是,logstash似乎並未創建彈性搜索索引。
這是我嘗試從elasticsearch卷曲索引時得到的結果:
[root@aoadbld00032lb ~]# curl -s http://127.0.0.1:9200/_status?pretty=true
{
"_shards" : {
"total" : 0,
"successful" : 0,
"failed" : 0
},
"indices" : { }
}
這就是我在logstash日志中看到的內容:
{:timestamp=>"2015-05-17T16:45:08.435000-0400", :message=>"Using version 0.1.x input plugin 'tcp'. This plugin isn't well supporte
d by the community and likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:08.449000-0400", :message=>"Using version 0.1.x codec plugin 'line'. This plugin isn't well support
ed by the community and likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:08.458000-0400", :message=>"Using version 0.1.x input plugin 'udp'. This plugin isn't well supported by the community and likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:08.462000-0400", :message=>"Using version 0.1.x codec plugin 'plain'. This plugin isn't well supported by the community and likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:08.474000-0400", :message=>"Using version 0.1.x filter plugin 'grok'. This plugin isn't well supported by the community and likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:08.482000-0400", :message=>"Using version 0.1.x filter plugin 'syslog_pri'. This plugin isn't well supported by the community and likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:08.500000-0400", :message=>"Using version 0.1. x filter plugin 'date'. This plugin isn't well supported by the community and likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:08.510000-0400", :message=>"Using version 0.1.x filter plugin 'mutate'. This plugin isn't well supported by the community and likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:08.808000-0400", :message=>"Using version 0.1.x output plugin 'elasticsearch'. This plugin isn't well supported by the community and likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:09.781000-0400", :message=>"Starting tcp input listener", :address=>"0.0.0.0:5000", :level=>:info}
{:timestamp=>"2015-05-17T16:45:09.807000-0400", :message=>"Starting UDP listener", :address=>"0.0.0.0:5000", :level=>:info}
我認為粗體輸出可能很重要!
這是我的logstash.conf文件:
[root@aoadbld00032lb ~]# cat /etc/logstash/logstash.conf
input {
tcp {
port => 5000
type => syslog
}
udp {
port => 5000
type => syslog
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOG5424PRI}%{NONNEGINT:syslog5424_ver} +(?:%{TIMESTAMP_ISO8601:syslog5424_ts}|-) +(?:%{HOSTNAME:syslog5424_host}|-) +(?:%{NOTSPACE:syslog5424_app}|-) +(?:%{NOTSPACE:syslog5424_proc}|-) +(?:%{WORD:syslog5424_msgid}|-) +(?:%{SYSLOG5424SD:syslog5424_sd}|-|) +%{GREEDYDATA:syslog5424_msg}" }
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
if !("_grokparsefailure" in [tags]) {
mutate {
replace => [ "@source_host", "%{syslog_hostname}" ]
replace => [ "@message", "%{syslog_message}" ]
}
}
mutate {
remove_field => [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
}
}
}
output {
elasticsearch {
host => "127.0.0.1"
embedded => false
cluster => "optl_elasticsearch"
}
}
我可以在彈性搜索中獲取如何獲取此logstash設置索引的建議嗎?
在按照本教程設置ELK之后,它為我創建了索引,可能對您有幫助。 使用生成器查找配置文件。
http://operational.io/elk-stack-for-network-operations-reloaded/
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.