Question

我正在学习elk，配置文件有问题：logstash.config这里是配置：

input {
       file {
             path => "E:/elk/log/access_test.log"
             start_position => beginning
       }
}
filter { 
       grok { 
             match => {
                "message" => "%{COMBINEDAPACHELOG}"
             }
       }
       date {
             locale => "en"
             match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z", "ISO8601" ]
       }
}
output {
        file {
              path => "E:/elk/log/logstash-access_test.log"
              start_position => beginning
       }
}

当我运行配置时，标题的错误将会出现。谁能告诉我原因？

Answer 1

输出文件插件没有start_position属性试试这个。

input {
       file {
             path => "E:/elk/log/access_test.log"
             start_position => beginning
       }
}
filter { 
        grok { 
              match => {
                        "message" => "%{COMBINEDAPACHELOG}"
              }
        }
        date {
              locale => "en"
              match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z", "ISO8601" ]
        }
}
output {
       file {
             path => "E:/elk/log/logstash-access_test.log"
       }
}

Answer 2

如果有帮助，使用--configtest调用logstash应该会提供更多信息 - 特别是行/列号。

希望这可以确认问题出在输出而不输入......

logstash配置错误：文件{：level =＆gt;：error}的未知设置'start_position'

2 个答案: