Logstash幾個小時之後，停止隨機

Question

我得到的隨機錯誤，當我運行logstash：

16：30：26.240 [[主要]> worker0] ERROR logstash.pipeline - 異常在 pipelineworker，所述管道停止處理新事件，請 檢查您的過濾器配置並重新啓動Logstash。 { 「異常」=>＃， 「回溯」=> [ 「組織/ jruby的/ RubyString.java：3101：在gsub'", "org/jruby/RubyString.java:3069:in GSUB」「， 」/usr/share/logstash/vendor/bundle/jruby/1.9/ gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb：317：in gsub_dynamic_fields'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:308:in gsub'「，」org/jruby/RubyArray.java：1613：in each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:290:in gsub'「， 」 /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:207:in filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in do_filter'「， 」/ usr /share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in multi_filter'", "org/jruby/RubyArray.java:1613:in each'「， 」/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb ：161：在 （eval）：4135：initialize'", "org/jruby/RubyArray.java:1613:in each'「，」（eval）：4131：in initialize'", "org/jruby/RubyProc.java:281:in call'「，」（eval）：997： filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:295:in filter_batch'「，」org/jruby /RubyProc.java:281:in call'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:192:in each'「，」org/jruby/RubyHash.java：1342：in each'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:191:in each'「， 」/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb 294：在 filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:282:in worker_loop'」， 「/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:258:in start_workers'"]} 16:30:26.542 [LogStash::Runner] FATAL logstash.runner - An unexpected error occurred! {:error=>#<InterruptedRegexpError: Regexp Interrupted>, :backtrace=>["org/jruby/RubyString.java:3101:in GSUB'」， 「組織/ JRuby中/ RubyString.java： 3069：在gsub'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:317:in gsub_dynamic_fields'「， 」/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb： 308： gsub'", "org/jruby/RubyArray.java:1613:in each'「， 」/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:290：在 gsub'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:207:in 濾波器」'， 「/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in multi_filter'」，「組織/ jruby的/ RubyArray.java：1613：在each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in multi_filter'」， 「/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:41:in multi_filter'", "(eval):4135:in初始化'」， 「組織/ JRuby中/ RubyArray.java：1613：在each'", "(eval):4131:in 初始化'「，」org/jruby/RubyProc.java：281：在call'", "(eval):997:in filter_func'「， 」/ usr/share/logstash/logstash-core/lib/logstash/p ipeline.rb：295：在 filter_batch'", "org/jruby/RubyProc.java:281:in呼叫」'， 「/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:192:in each'", "org/jruby/RubyHash.java:1342:in每個」「， 」的/ usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb：191： each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:294:in filter_batch'「， 」/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:282：在 worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:258:in start_workers'「]}

我logstash配置文件是：

input { 
    file { 
     type => "SystemError" 
     path => "/app/systemerr/**/*" 
     start_position => "beginning" 


     codec => multiline { 
      pattern => "^\s" 
      what => "previous" 
     }  
    } 

    file { 
     type => "SystemOut" 
     path => "/app/systemout/**/*" 
      start_position => "beginning" 


     codec => multiline { 
      pattern => "^\[" 
      negate => true 
      what => "previous" 
     } 
    } 

    file { 
      type => "Errorlog" 
     path => "/app/error/**/*" 
      start_position => "beginning" 


     codec => multiline { 
      pattern => "^FATAL" 
      negate => true 
      what => "previous" 
     } 
    } 

    file { 
      type => "Messagelog" 
     path => "/app/message/**/*" 
      start_position => "beginning" 


     codec => multiline { 
      pattern => "^ERROR" 
      negate => true 
      what => "previous" 
     }  
    } 
} 

filter { 
    if [type] == "SystemError" { 
     grok { 
      match => { "message" => "\[%{DATA:timestamp}] %{BASE16NUM:threadID} (?<shortname>\b[A-Za-z0-9\$]{2,}\b)%{SPACE}%{WORD:loglevel}%{SPACE} %{GREEDYDATA:message}" } 
      overwrite => [ "message" ] 
     } 

     mutate { 
      gsub => ["timestamp", " GMT\+05\:30", ""] 
     } 

     date { 
      match => ["timestamp", "M/dd/yy HH:mm:ss:SSS"] 
     } 

     if ([message] =~ "^\tat") { 
       drop {} 
     } 

     if ([path] =~ "113") { 
      mutate { 
        add_field => { "server" => "113" } 
      } 
     } else { 
      mutate { 
        add_field => { "server" => "117" } 
      } 
     } 

    } 

    if [type] == "SystemOut" { 
     grok { 
      match => { "message" => "\[%{DATA:timestamp}] %{BASE16NUM:threadID} (?<shortname>\b[A-Za-z0-9\$]{2,}\b)%{SPACE}%{WORD:loglevel}%{SPACE} %{GREEDYDATA:message}" } 
      overwrite => [ "message" ] 
     } 

     mutate { 
      gsub => ["timestamp", " GMT\+05\:30", ""] 
     } 

     date { 
      match => ["timestamp", "M/dd/yy HH:mm:ss:SSS"] 
     } 

     if ([path] =~ "113") { 
      mutate { 
        add_field => { "server" => "113" } 
      } 
     } else { 
      mutate { 
        add_field => { "server" => "117" } 
      } 
     }  
    } 

    if [type] == "Errorlog" { 
     grok { 
      match => { "message" => "%{LOGLEVEL:loglevel} \| %{TIMESTAMP_ISO8601:timestamp} \| %{DATA:string} \: %{DATA:WebContainer} \| %{DATA:code} \| %{DATA:country} \| %{DATA:user} \| %{GREEDYDATA:message}" } 
      overwrite => [ "message" ] 
     } 

     date { 
      match => ["timestamp", "yyyy-M-dd HH:mm:ss,SSS"] 
     } 

     mutate { remove_field => [ "string" ] } 

     if ([path] =~ "113") { 
      mutate { 
        add_field => { "server" => "113" } 
      } 
     } else { 
      mutate { 
        add_field => { "server" => "117" } 
      } 
     }  
    } 

    if [type] == "Messagelog" { 
     grok { 
      match => { "message" => "%{LOGLEVEL:loglevel} \| %{TIMESTAMP_ISO8601:timestamp} \| %{DATA:string} \: %{DATA:WebContainer} \| %{DATA:code} \| %{DATA:country} \| %{DATA:user} \| %{GREEDYDATA:message}" } 
      overwrite => [ "message" ] 
     } 

     date { 
      match => ["timestamp", "yyyy-M-dd HH:mm:ss,SSS"] 
     } 

     mutate { 
      remove_field => [ "string" ] 
     } 

     if ([path] =~ "113") { 
      mutate { 
        add_field => { "server" => "113" } 
      } 
     } else { 
      mutate { 
        add_field => { "server" => "117" } 
      } 
     }  

    } 

} 

配置文件有什麼問題嗎？請幫忙。

Answer 1

您很可能會收到_grokparsefailure，因此未設置timestamp字段。您可以環繞發生變異/日期與if塊這樣的：

if "_grokparsefailure" not in [tags] { 
    mutate { 
     gsub => ["timestamp", " GMT\+05\:30", ""] 
    } 

    date { 
     match => ["timestamp", "M/dd/yy HH:mm:ss:SSS"] 
    } 
} 

您可能還需要增加一個else { drop {} }，但是你應該弄清楚什麼是不是第一個匹配。