索引模式不是通過使用 http_poll 的 logstash 在 kibana 儀表板中創建的。 錯誤 -LogStash::ConfigurationError", :message=>"預期的 # 之一，

Question

我想從 logstash 調用其余的 api 並想將它發送到彈性搜索以在 kibana 儀表板中顯示數據。但我得到了錯誤 -

 [2019-12-23T16:55:24,887][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 14, column 25 (byte 243) after output {\r\nelasticsearch{\r\nhosts=>{\"localhost:9200\"", :backtrace=>["D:/elasticinstall/logstash-7.4.0/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "D:/elasticinstall/logstash-7.4.0/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "D:/elasticinstall/logstash-7.4.0/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2584:in `map'", "D:/elasticinstall/logstash-7.4.0/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:153:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "D:/elasticinstall/logstash-7.4.0/logstash-core/lib/logstash/java_pipeline.rb:26:in `initialize'", "D:/elasticinstall/logstash-7.4.0/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "D:/elasticinstall/logstash-7.4.0/logstash-core/lib/logstash/agent.rb:326:in `block in converge_state'"]}
    [2019-12-23T16:55:25,982][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
    [2019-12-23T16:55:30,292][INFO ][logstash.runner          ] Logstash shut down.


    logstash code
    input {
      http_poller {
        urls => {
         urlname =>"http://.."
         }
        }
        request_timeout => 60
        schedule => {every=>"20s"}
        codec => "line"
      }
    }


output {
elasticsearch{
hosts=>{"localhost:9200"}
index =>"logstash_http_poller"
}
  stdout {
    codec => rubydebug
  }
}

來自 powershell logstash -f logstash_http_poller.conf 的命令

Answer 1

您的elasticsearch輸出是錯誤的，您不需要主機周圍的花括號：

elasticsearch {
    hosts => "localhost:9200"                     <-- change this
    index => "logstash_http_poller"
}

Answer 2

input {
  http_poller {
    urls => 
    { 
    test1 => "rest api url"
    }
    request_timeout => 60
    # Supports "cron", "every", "at" and "in" schedules by rufus scheduler
    schedule => { cron => "* * * * * UTC"}
    codec => "json"
    # A hash of request metadata info (timing, response headers, etc.) will be sent here
    metadata_target => "http_poller_metadata"
  }
}

output {
  stdout {
    codec => rubydebug
  }
}