日志沒有從 logstash 推送到 elasticsearch

Question

logstash-config.conf

input {
 file {
path => ["D:/project/log/samplex.log"]
sincedb_path => "D:/Project/logstash-7.5.0/data/plugins/inputs/file/null"
start_position => "beginning"
}
}
output {
elasticsearch {
hosts => ["192.168.1.8:9200"]
index => "db"
#user => "elastic"
#password => "changeme"
 }  }

控制台日志

D:\\Project\\logstash-7.5.0\\bin>logstash -f logstash-sample.conf
Thread.exclusive 已棄用，使用 Thread::Mutex Sending Logstash 日志到 D:/Project/logstash-7.5.0/logs 現在通過 log4j2.properties [2019-12-16T23:26:28,465][WARN][ logstash.config.source.multilocal] 忽略“pipelines.yml”文件，因為指定了模塊或命令行選項
[2019-12-16T23:26:28,580][INFO][logstash.runner] 啟動 Logstash
{"logstash.version"=>"7.5.0"} [2019-12-16T23:26:30,143][INFO][org.reflections.Reflections] 反射用了 32 毫秒掃描 1 個 url，產生 20 個鍵和 40 個值[2019-12-16T23:26:31,024][INFO][logstash.outputs.elasticsearch][main] Elasticsearch 池 URL 更新 {:changes=>{:removed=>[], : added=>[ http:// 192.168.1.8:9200/] }} [2019-12-16T23:26:31,201][WARN][logstash.outputs.elasticsearch][main] 恢復到 ES 實例的連接 {:url=>" http://192.168。 1.8:9200/ "} [2019-12-16T23:26:31,256][INFO][logstash.outputs.elasticsearch][main] ES 輸出版本確定 {:es_version=>7} [2019-12-16T23:26: 31,264][WARN][logstash.outputs.elasticsearch][main] 檢測到 6.x 及以上的集群： type事件字段不會用於確定文檔 _type {:es_version=>7} [2019-12- 16T23:26:31,333][INFO][logstash.outputs.elasticsearch][main] 新的 Elasticsearch 輸出 {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//192.168.1.8:9200 "]} [2019-12-16T23:26:31,404][INFO][logstash.outpu ts.elasticsearch][main] 使用默認映射模板 [2019-12-16T23:26:31,439][WARN][org.logstash.instrument.metrics.gauge.LazyDelegatingGauge][main] 未知類型（org .jruby.specialized.RubyArrayOneObject) 已為鍵創建：cluster_uuids。 這可能會導致無效的序列化。 建議將問題記錄到負責的開發人員/開發團隊。 [2019-12-16T23:26:31,449][信息][logstash.javapipeline
][main] 啟動管道 {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight "=>1000, "pipeline.sources"=>["D:/Project/logstash-7.5.0/bin/logstash-sample.conf"], :thread=>"#"} [2019-12-16T23: 26:31,506][INFO][logstash.outputs.elasticsearch][main] 嘗試安裝模板 {:manage_template=>{"index_patterns"=>"logstash- ", "version"=>60001, "settings"=>{ "index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type" =>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>" ", "match_mapping_type"= >"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above "=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"} , "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_poin t"}, "緯度"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}} [2019-12-16T23:26: 32,041][INFO][logstash.javapipeline][main] 管道開始 {"pipeline.id"=>"main"} [2019-12-16T23:26:32,114][INFO][filewatch.observingtail][main] START , 創建 Discoverer, Watch with file and sincedb collections [2019-12-16T23:26:32,118][INFO][logstash.agent] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines= >[]} [2019-12-16T23:26:32,502][INFO][logstash.agent] 成功啟動 Logstash API 端點 {:port=>9600}

logstash 不讀取提到的日志文件並且它處於空閑狀態。

樣本日志

[2019-12-16T22:30:59,310][INFO][logstash.outputs.elasticsearch][main] Elasticsearch 池 URL 更新 {:changes=>{:removed=>[], : added=>[ http:// 192.168.1.8:9200/] }} [2019-12-16T22:30:59,472][WARN][logstash.outputs.elasticsearch][main] 恢復到 ES 實例的連接 {:url=>" http://192.168。 1.8:9200/ "} [2019-12-16T22:30:59,558][INFO][logstash.outputs.elasticsearch][main] ES 輸出版本確定 {:es_version=>7} [2019-12-16T22:30: 59,565][WARN][logstash.outputs.elasticsearch][main] 檢測到 6.x 及以上的集群： type事件字段不會用於確定文檔 _type {:es_version=>7} [2019-12- 16T22:30:59,653][INFO][logstash.outputs.elasticsearch][main] 新的 Elasticsearch 輸出 {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//192.168.1.8:9200 "]} [2019-12-16T22:30:59,724][INFO][logstash.outputs.elasticsearch][main] 使用默認映射模板 dsdasd

Answer 1

在 Windows 中，我認為您保存的文件名是 sample.log 但在內部它會被視為文本文件。 所以它會像“sample.log.txt”

所以請嘗試

input {
file {
#type => "log"
path => "D:/Downloads/logstash-6.7.0/bin/samplex.log.txt"
sincedb_path => "D:/Downloads/logstash-6.7.0/data/plugins/inputs/file/null"
start_position => "beginning"
#ignore_older => 0
}
}



output {
stdout { codec => "rubydebug"}
elasticsearch {
hosts => "http://xx-xx-xx-xx:9200"
index => "db"
} 
}

如果問題仍然存在，請嘗試刪除sincedb_path 中的空文件，然后重試。

如果問題得到解決，請告訴我。 希望這對你有幫助.. !!