logstash启动仍然报错，我的
logstash配置如下：
api
-templ
ate
.json
{
"index_p
atterns"
: ["outsideg
ateway
-request
-*"],
"settings"
: {
"number_
of_shards"
: 1,
"number_
of_replicas"
: 0
},
"mappings"
: {
"properties"
: {
"id"
: { "type"
: "keyword" },
"time"
: { "type"
: "d
ate" },
"host"
: { "type"
: "keyword" },
"message"
: { "type"
: "text" },
"app_key"
: { "type"
: "keyword" },
"api_id"
: { "type"
: "text" },
"service_id"
: { "type"
: "keyword" },
"p
ath"
: { "type"
: "keyword" },
"request"
: { "type"
: "text" },
"http_st
atus_code"
: { "type"
: "keyword" },
"response_time"
: { "type"
: "long" },
"result"
: { "type"
: "text" },
"namespace"
: { "type"
: "text" },
"group"
: { "type"
: "text" },
"nonce"
: { "type"
: "text" },
"ip"
: { "type"
: "text" },
"afterValues"
: { "type"
: "object" }
}
}
}
api_log
.conf
input {
file {
p
ath
=> "/d
ata/logs/api/g
ateway
-api
-access
-*
.log"
start_position
=> "beginning"
sincedb_p
ath
=> "/usr/share/
logstash/sincedb/g
ateway_api
.sincedb"
codec
=> "json"
# 启用文件名解析以支持日志轮转
file_completed_action
=> "log_and_forget"
file_sort_by
=> "mtime"
}
}
filter {
# 删除无用字段
mut
ate {
remove_field
=> [
"@version",
"false",
"logger_name",
"thread_name",
"level_value",
"activePr
ofile"
]
}
# 字段重命名归类，并确保与Elasticsearch索引结构相匹配
mut
ate {
rename
=> {
"id"
=> "[id]"
"time"
=> "[time]"
"host"
=> "[host]"
"message"
=> "[message]"
"app_key"
=> "[app_key]"
"api_id"
=> "[api_id]"
"service_id"
=> "[service_id]"
"p
ath"
=> "[p
ath]"
"uri"
=> "[request]"
"http_st
atus_code"
=> "[http_st
atus_code]"
"response_time"
=> "[response_time]"
"result"
=> "[result]"
"namespace"
=> "[namespace]"
"group"
=> "[group]"
"nonce"
=> "[nonce]"
"ip"
=> "[ip]"
"afterValues"
=> "[afterValues]"
}
}
# 如果需要将某些字段转换为特定类型（例如 d
ate 类型的时间戳）
if [time] {
d
ate {
m
atch
=> ["time", "yyyy
-MM
-dd HH
:mm
:ss
.SSS"]
target
=> "@timestamp"
}
}
# 确保 response_time 是 long 类型
mut
ate {
convert
=> { "response_time"
=> "long" }
}
# 添加 log_type 标识
mut
ate {
add_field
=> { "log_type"
=> "g
ateway_api_access" }
}
}
output {
elasticsearch {
hosts
=> ["elasticsearch
:9200"]
index
=> "outsideg
ateway
-request
-%{+YYYY
.MM}"
document_type
=> "_doc"
# 映射规则，确保
Logstash输出的数据符合Elasticsearch的索引结构
templ
ate
=> "api
-templ
ate
.json"
templ
ate_name
=> "outsideg
ateway
-request"
templ
ate_overwrite
=> true
}
# 可选：调试输出
stdout {
codec
=> rubydebug
}
}
报错如下：
[ERROR] 2025
-06
-20 19
:17
:08
.948 [Converge Pipe
lineAction
::Cre
ate<api_log>] file
- Invalid setting for file input plugin
:
input {
file {
# Th
is setting must be a ["last_modified", "p
ath"]
# Expected one of ["last_modified", "p
ath"], got ["mtime"]
file_sort_by
=> "mtime"
...
}
}
[ERROR] 2025
-06
-20 19
:17
:08
.951 [Converge Pipe
lineAction
::Cre
ate<api_log>] file
- Invalid setting for file input plugin
:
input {
file {
# Th
is setting must be a ["delete", "log", "log_and_delete"]
# Expected one of ["delete", "log", "log_and_delete"], got ["log_and_forget"]
file_completed_action
=> "log_and_forget"
...
}
}
[ERROR] 2025
-06
-20 19
:17
:08
.954 [Converge Pipe
lineAction
::Cre
ate<api_log>] agent
- Failed to execute action {
:action
=>
LogStash::Pipe
lineAction
::Cre
ate/pipe
line_id
:api_log,
:exception
=>"
LogStash::ConfigurationError",
:message
=>"Something
is wrong with your
configuration.",
:backtrace
=>["/usr/share/
logstash/
logstash-core/lib/
logstash/config/mixin
.rb
:86
:in `config_init&
#39;", "/usr/share/
logstash/
logstash-core/lib/
logstash/inputs/base
.rb
:60
:in `initialize&
#39;", "org/
logstash/plugins/PluginFactoryExt
.java
:255
:in `plugin&
#39;", "org/
logstash/plugins/PluginFactoryExt
.java
:117
:in `buildInput&
#39;", "org/
logstash/execution/JavaBasePipe
lineExt
.java
:50
:in `initialize&
#39;", "/usr/share/
logstash/
logstash-core/lib/
logstash/java_pipe
line
.rb
:23
:in `initialize&
#39;", "/usr/share/
logstash/
logstash-core/lib/
logstash/pipe
line_action/cre
ate
.rb
:36
:in `execute&
#39;", "/usr/share/
logstash/
logstash-core/lib/
logstash/agent
.rb
:325
:in `block in converge_st
ate&
#39;"]}
[INFO ] 2025
-06
-20 19
:17
:09
.072 [Api Webserver] agent
- Successfully started
Logstash API endpoint {
:port
=>9600}
[INFO ] 2025
-06
-20 19
:17
:14.089 [
LogStash::Runner]
runner - Logstash shut down
.
本文详细解析了Logstash配置文件中常见的错误原因，包括拼写错误和符号遗漏，并提供了具体的测试命令来验证配置是否正确，旨在帮助开发者快速定位并解决配置问题。
扫一扫
1617
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
