Question

我配置了logstash转发器并尝试解析日志文件。希望我通过引用logstash book正确地完成了所有步骤。运行logstash配置文件和logstash转发器时我没有看到任何错误，但文件解析不是开始。

以下是我的配置详情

1. cat /etc/logstash/central.conf
input {
lumberjack {
port => 6782
ssl_certificate => "/etc/logstash/server.crt"
ssl_key => "/etc/logstash/server.key"
type => "lumberjack"
}
}
output {
stdout { codec => rubydebug }
}
2. cat logstash-forwarder.conf
{
"network": {
"servers": [ "54.227.XXX.XXX:6782" ],
"ssl ca": "/etc/logstash-forwarder/server.crt",
"ssl key": "/etc/logstash-forwarder/server.key",
"timeout": 15`enter code here`
},
"files": [
{
"paths": [
"/opt/logs/L/*.log"
]

logstash的输出

sudo bin / logstash -f /etc/logstash/central.conf 使用里程碑1输入插件'lumberjack'。这个插件应该可以工作，但是会受到像你这样的人的使用。如果您发现错误或有关如何改进此插件的建议，请告诉我们。有关插件里程碑的详细信息，请参阅http://logstash.net/docs/1.4.2/plugin-milestones {：level =＆gt;：warn}

Logstash-forwarder的输出

ubuntu @ ip-10-231-15-32：〜$ / opt / lumberjack / bin / lumberjack -config /etc/logstash-forwarder/logstash-forwarder.conf

-fro                                                                                m-beginning=true
2015/01/13 12:55:09 publisher init
2015/01/13 12:55:09 {
"network": {
"servers": [ "54.227.XXX.XXX:6782" ],
"ssl ca": "/etc/logstash-forwarder/server.crt",
"ssl key": "/etc/logstash-forwarder/server.key",
"timeout": 15
},
"files": [
{
"paths": [
"/opt/logs/L/*.log"
]
}
]
}

2015/01/13 12:55:09.498742 Setting trusted CA from file: /etc/logstash-forwarder/server.crt
2015/01/13 12:55:09.499091 Connecting to 54.227.XXX.XXX:6782
2015/01/13 12:55:09.566860 Connected to 54.227.XXX.XXX:6782

任何建议？

Answer 1

logstash-forwarder应记录在网络连接之前找到的文件。请重新检查运行logstash-forwarder的用户可以执行的文件和目录权限

ls /opt/logs/L/*.log

和

cat /opt/logs/L/*.log

Logstash-forwarder无法正常工作

1 个答案: