logstash启动仍然报错，我的logstash配置如下：
api-template.json
{
"index_patterns"
: ["outsidegateway-request-*"],
"settings"
: {
"number_
of_shards"
: 1,
"number_
of_replicas"
: 0
},
"mappings"
: {
"properties"
: {
"id"
: { "
type"
: "keyword" },
"time"
: { "
type"
: "date" },
"host"
: { "
type"
: "keyword" },
"message"
: { "
type"
: "text" },
"app_key"
: { "
type"
: "keyword" },
"api_id"
: { "
type"
: "text" },
"service_id"
: { "
type"
: "keyword" },
"path"
: { "
type"
: "keyword" },
"request"
: { "
type"
: "text" },
"http_status_code"
: { "
type"
: "keyword" },
"response_time"
: { "
type"
: "long" },
"result"
: { "
type"
: "text" },
"namespace"
: { "
type"
: "text" },
"group"
: { "
type"
: "text" },
"nonce"
: { "
type"
: "text" },
"ip"
: { "
type"
: "text" },
"afterValues"
: { "
type"
: "object" }
}
}
}
api_log.conf
input {
file {
path => "/data/logs/api/gateway-api-access-*.log"
start_position => "beginning"
sincedb_path => "/usr/share/logstash/sincedb/gateway_api.sincedb"
codec => "json"
# 启用文件名解析以支持日志轮转
file_completed_
action => "log_and_forget"
file_sort_by => "mtime"
}
}
filter {
# 删除无用字段
mutate {
remove_field => [
"@version",
"false",
"logger_name",
"thread_name",
"level_value",
"activePr
ofile"
]
}
# 字段重命名归类，并确保与Elasticsearch索引结构相匹配
mutate {
rename => {
"id" => "[id]"
"time" => "[time]"
"host" => "[host]"
"message" => "[message]"
"app_key" => "[app_key]"
"api_id" => "[api_id]"
"service_id" => "[service_id]"
"path" => "[path]"
"uri" => "[request]"
"http_status_code" => "[http_status_code]"
"response_time" => "[response_time]"
"result" => "[result]"
"namespace" => "[namespace]"
"group" => "[group]"
"nonce" => "[nonce]"
"ip" => "[ip]"
"afterValues" => "[afterValues]"
}
}
# 如果需要将某些字段转换为特定类型（例如 date 类型的时间戳）
if [time] {
date {
match => ["time", "yyyy-MM-dd HH
:mm
:ss.SSS"]
target => "@timestamp"
}
}
# 确保 response_time 是 long 类型
mutate {
convert => { "response_time" => "long" }
}
# 添加 log_
type 标识
mutate {
add_field => { "log_
type" => "gateway_api_access" }
}
}
output {
elasticsearch {
hosts => ["elasticsearch
:9200"]
index => "outsidegateway-request-%{+YYYY.MM}"
document_
type => "_doc"
# 映射规则，确保Logstash输出的数据符合Elasticsearch的索引结构
template => "api-template.json"
template_name => "outsidegateway-request"
template_overwrite => true
}
# 可选：调试输出
stdout {
codec => rubydebug
}
}
报错如下：
[ERROR] 2025-06-20 19
:17
:08.948 [Converge Pipeline
Action::Create<api_log>] file - Invalid setting for file input plugin
:
input {
file {
# This setting must be a ["last_modified", "path"]
# Expected one
of ["last_modified", "path"], got ["mtime"]
file_sort_by => "mtime"
...
}
}
[ERROR] 2025-06-20 19
:17
:08.951 [Converge Pipeline
Action::Create<api_log>] file - Invalid setting for file input plugin
:
input {
file {
# This setting must be a ["delete", "log", "log_and_delete"]
# Expected one
of ["delete", "log", "log_and_delete"], got ["log_and_forget"]
file_completed_
action => "log_and_forget"
...
}
}
[ERROR] 2025-06-20 19
:17
:08.954 [Converge Pipeline
Action::Create<api_log>] agent - Failed to execute
action {
:action=>LogStash
::Pipeline
Action::Create/pipeline_id
:api_log,
:exception=>"LogStash
::ConfigurationError",
:message=>"Something is wrong with your configuration.",
:backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/config/mixin.rb
:86
:in `config_init'", "/usr/share/logstash/logstash-core/lib/logstash/inputs/base.rb
:60
:in `
initialize'", "org/logstash/plugins/PluginFactoryExt.
java:255
:in `plugin'", "org/logstash/plugins/PluginFactoryExt.
java:117
:in `buildInput'", "org/logstash/execution/
JavaBasePipelineExt.
java:50
:in `
initialize'", "/usr/share/logstash/logstash-core/lib/logstash/
java_pipeline.rb
:23
:in `
initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_
action/create.rb
:36
:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb
:325
:in `block in converge_state'"]}
[INFO ] 2025-06-20 19
:17
:09.072 [Api Webserver] agent - Successfully started Logstash API endpoint {
:port=>9600}
[INFO ] 2025-06-20 19
:17
:14.089 [LogStash
::Runner] runner - Logstash shut down.
本文解决了Struts框架中Action的两种execute方法引起的常见问题。介绍了两种方法的区别，并推荐使用带有ActionMapping、ActionForm、HttpServletRequest及HttpServletResponse参数的方法。
扫一扫
377
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
