首页 文章

无法将Filebeat连接到logstash以使用ELK进行日志记录

提问于
浏览
0

嗨,我一直在使用弹性堆栈进行自动记录 . 我有 filebeat 正在从路径读取日志,并且输出设置为通过端口 5044 进行logstash . logstash配置有一个输入,监听 5044 并输出推送到localhost:9200 . 问题是我可以发生这种情况 . 以下是文件:

My filebeat.yml 路径: etc/filebeat/filebeat.yml

#=========================== Filebeat prospectors =============================

filebeat.prospectors:

# Each - is a prospector. Most options can be set at the prospector level, so
# you can use different prospectors for various configurations.
# Below are the prospector specific configurations.

- input_type: log

# Paths that should be crawled and fetched. Glob based paths.
paths:
- /mnt/vol1/autosuggest/logs/*.log
#- c:\programdata\elasticsearch\logs\*
<other commented stuff>
#----------------------------- Logstash output --------------------------------
output.logstash:
# The Logstash hosts
hosts: ["10.10.XX.XX:5044"]

# Optional SSL. By default is off.
<other commented stuff>

My logstash.yml 路径: etc/logstash/logstash.yml

<other commented stuff>
path.data: /var/lib/logstash
<other commented stuff>
path.config: /etc/logstash/conf.d
<other commented stuff>

# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#
http.host: "10.10.XX.XX"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
# http.port: 9600-9700
<other commented stuff>
path.logs: /var/log/logstash
<other commented stuff>

My logpipeline30aug.config file 路径: /usr/share/logstash

input {
  beats {
  port => 5044
  }
}

filter {
  grok {
match => { "message" => "\A%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{WORD:var0}%{SPACE}%{NOTSPACE}%{SPACE}(?<searchinfo>[^#]*)#(?<username>[^#]*)#(?<searchQuery>[^#]*)#(?<latitude>[^#]*)#(?<longitude>[^#]*)#(?<client_ip>[^#]*)#(?<responseTime>[^#]*)" }
  }
}

output {
   elasticsearch {
      hosts => ["http://localhost:9200"]
      index => "logstash30aug2017"
      document_type => "log"
   }
}

Please Note: Elasticsearch,logstash,filebeat都安装在同一台机器上,而ip: 10.10.XX.XX 和我've checked the firewall, it' s肯定不是问题 .

我检查了logstash,filebeat服务都在运行 . Filebeat能够在配置时将数据推送到elasticsearch,并且logstash能够在配置时将数据推送到elasticsearch .


也许这就是我执行流程的方式就是问题..我在 /usr/share/logstash 中执行 bin/logstash -f logpipeline30aug.config 启动它,然后从根目录执行 /etc/init.d/filebeat start .

Please Note: 由于stackoverflow格式化问题,可能会影响格式化

有人可以帮忙吗?我已经尝试了3天以来的所有事情,我也完成了文档

1 回答

  • 2

    您的filebeat.yml看起来无效 .

    输出部分缺少缩进:

    output.logstash:
      hosts: ["10.10.XX.XX:5044"]
    

    通常,检查配置文件的正确性以确保它们没问题 .

    例如,对于filebeat,您可以运行:

    filebeat -c /etc/filebeat/filebeat.yml -configtest
    

    如果您有任何错误,它会解释该错误是什么,以便您可以解决它 .

    您也可以对其他ELK服务使用类似的方法

相关问题