Logstash不與filebeat一起運行

Question

我正在關注數字海洋指南以安裝ELK堆棧。它正在運行，但現在我遇到了logstash的問題。

當我運行調試，我得到這個::

tail -f /var/log/logstash/logstash.log 

{:timestamp=>"2017-02-10T10:38:05.169000-0500", :message=>"Error: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after "} 
{:timestamp=>"2017-02-10T10:38:05.201000-0500", :message=>"You may be interested in the '--configtest' flag which you can\nuse to validate logstash's configuration before you choose\nto restart a running system."} 
{:timestamp=>"2017-02-14T10:51:46.921000-0500", :message=>"fetched an invalid config", :config=>"input {\n lumberjack {\n port => 5044\n type => syslog\n ssl_certificate => \"/etc/pki/tls/certs/logstash-forwarder.crt\"\n ssl_key => \"/etc/pki/tls/private/logstash-forwarder.key\"\n }\n}\n\ninput {\n beats {\n port => 5044\n ssl => true\n ssl_certificate => \"/etc/pki/tls/certs/logstash-forwarder.crt\"\n ssl_key => \"/etc/pki/tls/private/logstash-forwarder.key\"\n }\n}\n\nfilter {\n if [type] == \"syslog\" {\n grok {\n  match => { \"message\" => \"%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\\[%{POSINT:syslog_pid}\\])?: %{GREEDYDATA:syslog_message}\" }\n  add_field => [ \"received_at\", \"%{@timestamp}\" ]\n  add_field => [ \"received_from\", \"%{host}\" ]\n }\n syslog_pri { }\n date {\n  match => [ \"syslog_timestamp\", \"MMM d HH:mm:ss\", \"MMM dd HH:mm:ss\" ]\n }\n }\n}\n\ninput{\n beats {\n port => 5044\n }\n}\n\noutput {\n elasticsearch {\n hosts => \"10.84.234.224:9200\"\n manage_template => false\n index => \"%{[@metadata][beat]}-%{+YYYY.MM.dd}\"\n document_type => \"%{[metadata][type]}\"\n }\n}\n\noutput {\n elasticsearch {\n hosts => [\"localhost:9200\"]\n sniffing => true\n manage_template => false\n index => \"%{[@metadata][beat]}-%{+YYYY.MM.dd}\"\n document_type => \"%{[@metadata][type]}\"\n }\n\u007Fstdout { codec => rubydebug }\n}\n\noutput {\n elasticsearch { host => localhost }\n stdout { codec => rubydebug }\n}\n\ninput {\n tcp {\n port => 5400\n type => syslog\n }\n udp {\n port => 5400\n type => syslog\n }\n}\n\nfilter {\n if [type] == \"syslog\" {\n grok {\n  match => { \"message\" => \"%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\\[%{POSINT:syslog_pid}\\])?: %{GREEDYDATA:syslog_message}\" }\n  add_field => [ \"received_at\", \"%{@timestamp}\" ]\n  add_field => [ \"received_from\", \"%{host}\" ]\n }\n date {\n  match => [ \"syslog_timestamp\", \"MMM d HH:mm:ss\", \"MMM dd HH:mm:ss\" ]\n }\n }\n}\n\noutput {\n elasticsearch { hosts => [\"localhost:9200\"] }\n stdout { codec => rubydebug }\n}\n\n\n", :reason=>"Expected one of #, if, \", ', } at line 56, column 1 (byte 1278) after output {\n elasticsearch {\n hosts => [\"localhost:9200\"]\n sniffing => true\n manage_template => false\n index => \"%{[@metadata][beat]}-%{+YYYY.MM.dd}\"\n document_type => \"%{[@metadata][type]}\"\n }\n", :level=>:error} 

不過，我想刪除我的伐木工人confs，我無法找到任何我CONFIGS的問題。有誰知道是否有辦法重新安裝logstash。我想我已經搞砸了太多confs，logstash，logstash，轉發等

的conf文件：

input { 
    beats { 
    port => 5044 
    ssl => true 
    ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt" 
    ssl_key => "/etc/pki/tls/private/logstash-forwarder.key" 
    } 
} 

filter { 
    if [type] == "syslog" { 
    grok { 
     match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" } 
     add_field => [ "received_at", "%{@timestamp}" ] 
     add_field => [ "received_from", "%{host}" ] 
    } 
    syslog_pri { } 
    date { 
     match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ] 
    } 
    } 
} 

output { 
    elasticsearch { 
    host => ["localhost:9200"] 
    sniffing => true 
    manage_template => false 
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" 
    document_type => "%{[@metadata][type]}" 
    } 
} 

UPDATE 當我運行一個configtest，我得到這個錯誤：

sudo service logstash configtest 

/etc/init.d/logstash: 156: /etc/init.d/logstash: /opt/logstash/bin/logstash: not found 

Answer 1

注意logstash作爲服務從/etc/logstash/conf.d閱讀所有文件，因此，如果您編輯只有一個，這並不意味着它會重新加載並修復行吟詩人r文件。

我不確定你正在編輯什麼文件，但是你有很多logstash一起追加的文件。

例如，一個文件有這個

input { 
    tcp { 
    port => 5400 
    type => syslog 
    } 
    udp { 
    port => 5400 
    type => syslog 
    } 
} 

另一個有這個

input{ 
    beats { 
    port => 5044 
    } 
} 

等等......所以，檢查所有文件/etc/logstash/conf.d爲單獨使用logstash --configtest錯誤，因爲錯誤說。

---

如果你看看你的錯誤消息的結束......

:reason=>"Expected one of #, if, \", ', } at line 56, column 1 (byte 1278) after ...

output { 
    elasticsearch { 
    hosts => [\"localhost:9200\"] 
    sniffing => true 
    manage_template => false 
    index => \"%{[@metadata][beat]}-%{+YYYY.MM.dd}\" 
    document_type => \"%{[@metadata][type]}\" 
    } 

您似乎缺少output {}一個右括號，或者說上線56壞/缺少的，它認爲。

---

我不知道什麼是錯的configtest，但你並不需要該服務。命令logstash --configtest可以測試你自己的文件。