logstash配置執行彈性搜索命令

Question

我正在通過主機ubuntu 16.04在3個docker容器中運行ELK堆棧，問題是在配置logstash.conf文件以執行“ifconfig”或“netstat -ano”之類的命令后出現錯誤。 我的logstash.conf文件是：

 input { exec { command => "netsat -ano" codec => "json" interval => 5 } } output{ elasticsearch { hosts => ["elasticsearch:9200"]} } i get this error after entering this command ( docker run -h logstash --name logstash --link elasticsearch:elasticsearch -it --rm -v "$PWD":/config-dir logstash -f /config-dir/logstash1.conf) 

14:29:30.703 [[main]<exec] ERROR logstash.inputs.exec - Error while running command {:command=>"netsat -ano", :e=>#<IOError: Cannot run program "netsat" (in directory "/"): error=2, No such file or directory>, :backtrace=>["org/jruby/RubyIO.java:4380:in `popen'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-exec-3.1.2/lib/logstash/inputs/exec.rb:76:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-exec-3.1.2/lib/logstash/inputs/exec.rb:75:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-exec-3.1.2/lib/logstash/inputs/exec.rb:40:in `inner_run'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-exec-3.1.2/lib/logstash/inputs/exec.rb:34:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:443:in `inputworker'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:436:in `start_input'"]}

任何人都可以幫助，請提前感謝！

Answer 1

您將需要為這些命令提供完整路徑，因為運行的Logstash不包含這些目錄。

input {
  exec {
    command => "/bin/netsat -ano"
    codec => "json"
    interval => 5
  }

}