嗨,我一直在使用弹性堆栈进行自动记录 . 我有 filebeat
正在从路径读取日志,并且输出设置为通过端口 5044
进行logstash . logstash配置有一个输入,监听 5044
并输出推送到localhost:9200 . 问题是我可以发生这种情况 . 以下是文件:
My filebeat.yml 路径: etc/filebeat/filebeat.yml
#=========================== Filebeat prospectors =============================
filebeat.prospectors:
# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.
- input_type: log
# Paths that should be crawled and fetched. Glob based paths.
paths:
- /mnt/vol1/autosuggest/logs/*.log
#- c:\programdata\elasticsearch\logs\*
<other commented stuff>
#----------------------------- Logstash output --------------------------------
output.logstash:
# The Logstash hosts
hosts: ["10.10.XX.XX:5044"]
# Optional SSL. By default is off.
<other commented stuff>
My logstash.yml 路径: etc/logstash/logstash.yml
<other commented stuff>
path.data: /var/lib/logstash
<other commented stuff>
path.config: /etc/logstash/conf.d
<other commented stuff>
# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#
http.host: "10.10.XX.XX"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
# http.port: 9600-9700
<other commented stuff>
path.logs: /var/log/logstash
<other commented stuff>
My logpipeline30aug.config file 路径: /usr/share/logstash
input {
beats {
port => 5044
}
}
filter {
grok {
match => { "message" => "\A%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{WORD:var0}%{SPACE}%{NOTSPACE}%{SPACE}(?<searchinfo>[^#]*)#(?<username>[^#]*)#(?<searchQuery>[^#]*)#(?<latitude>[^#]*)#(?<longitude>[^#]*)#(?<client_ip>[^#]*)#(?<responseTime>[^#]*)" }
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "logstash30aug2017"
document_type => "log"
}
}
Please Note: Elasticsearch,logstash,filebeat都安装在同一台机器上,而ip: 10.10.XX.XX
和我've checked the firewall, it' s肯定不是问题 .
我检查了logstash,filebeat服务都在运行 . Filebeat能够在配置时将数据推送到elasticsearch,并且logstash能够在配置时将数据推送到elasticsearch .
也许这就是我执行流程的方式就是问题..我在 /usr/share/logstash
中执行 bin/logstash -f logpipeline30aug.config
启动它,然后从根目录执行 /etc/init.d/filebeat start
.
Please Note: 由于stackoverflow格式化问题,可能会影响格式化
有人可以帮忙吗?我已经尝试了3天以来的所有事情,我也完成了文档
1 回答
您的filebeat.yml看起来无效 .
输出部分缺少缩进:
通常,检查配置文件的正确性以确保它们没问题 .
例如,对于filebeat,您可以运行:
如果您有任何错误,它会解释该错误是什么,以便您可以解决它 .
您也可以对其他ELK服务使用类似的方法