Question

我有LS_JAVA_OPTS = -DproxySet=true -Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort=8888

然而，我从Fiddler的logstash看到我的弹性搜索节点没有流量。

我知道我的弹性搜索已启动并正在运行。当我卷曲它时，Fiddler会清楚地显示请求，因此jruby不会通过Fiddler路由请求。

我没有直接打电话给jruby。而是使用bin\logstash.bat脚本。

附录

我的conf文件：

input {
    file {
        path => 'c:/log/bje-Error.log'
        sincedb_path => "NUL"
        codec => plain {
            charset => "ISO-8859-1"
        }
        codec => multiline {
            pattern => "^%{TIMESTAMP_ISO8601} "
            negate => true
            what => previous
        }
        start_position => beginning
        ignore_older => 0
    }
}
filter {
    grok {
        match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} \[%{BASE10NUM:thread:int}] %{WORD:machine}:%{WORD:service} \[%{BASE10NUM:localId:int}?:%{UUID:logId}?:(?<jobKind>[^:]+)?:%{BASE10NUM:jobDefinitionId:int}? %{WORD:namespace}?:%{WORD:job}?:(?<customCtx>[^\]]*)\] %{LOGLEVEL:level} %{NOTSPACE:logger} - (?<text>(?m:.*))" }
    }
}
output {
    stdout { codec => rubydebug }
    elasticsearch {
        document_type => 'logs_bje'
        hosts => ["ncesearch01"]
    }
}

在powershell中进行测试：

PS E:\logstash-2.3.2\bin> (ConvertFrom-Json((Invoke-WebRequest "http://ncesearch01:9200/logstash-*/_count").Content)).count
24666
PS E:\logstash-2.3.2\bin> .\logstash.bat -f C:\dayforce\DayforceDEV\elk\logstach.conf
LS_JAVA_OPTS was set to [-DproxySet=true -Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort=8888]. This will be appended to the JAVA_OPTS [ -XX:HeapDumpPath="$LS_HOME/heapdump.hprof"]
io/console not supported; tty will not be manipulated
Settings: Default pipeline workers: 12
Pipeline main started
{
            "message" => "2016-05-02 16:00:05.7079 [111] CANWS212:MyBJE [2251:e2737eeb-40d6-4b0e-9608-75ee3de894d3:ScheduledInstance:16 DFUnitTest:BillingDataCollectionJob:] ERROR
SharpTop.Engine.BackgroundJobs.Billing.BillingDataCollectionJob - The client database version is not defined in DFDatabaseIdentification  \r",
           "@version" => "1",
         "@timestamp" => "2016-05-03T03:40:50.531Z",
               "path" => "c:/log/bje-Error.log",
               "host" => "CANWS212",
          "timestamp" => "2016-05-02 16:00:05.7079",
             "thread" => 111,
            "machine" => "CANWS212",
            "service" => "MyBJE",
            "localId" => 2251,
              "logId" => "e2737eeb-40d6-4b0e-9608-75ee3de894d3",
            "jobKind" => "ScheduledInstance",
    "jobDefinitionId" => 16,
          "namespace" => "DFUnitTest",
                "job" => "BillingDataCollectionJob",
              "level" => "ERROR",
             "logger" => "SharpTop.Engine.BackgroundJobs.Billing.BillingDataCollectionJob",
               "text" => "The client database version is not defined in DFDatabaseIdentification  \r"
}
^CTerminate batch job (Y/N)? ←[33mSIGINT received. Shutting down the agent. {:level=>:warn}←[0m
stopping pipeline {:id=>"main"}
Pipeline main has been shutdown
The signal HUP is in use by the JVM and will not work correctly on this platform

^CPS E:\logstash-2.3.2\bin> (ConvertFrom-Json((Invoke-WebRequest "http://ncesearch01:9200/logstash-*/_count").Content)).count
24667
PS E:\logstash-2.3.2\bin>

如您所见，http://ncesearch01:9200/logstash-*/_count返回递增计数，因此运行logstash确实向elasticsearch发送了请求。然而，尽管有LS_JAVA_OPTS，它绕过了Fiddler。

Answer 1

我找到了这种情况的一些可能原因，虽然我没有尝试。可能这个答案应该被称为“讨论”，对不起。

1.You may need a linux OS instead of windows，for the reason，
  I am not sure this question has been deal in the latest logstash version

您可能对此感兴趣，Make JAVA_OPTS and LS_JAVA_OPTS work consistently on Windows

2.As we see，the most possible is that
  logstash ES_output plugin use the http way to send message 
  after logstash-2.0,you may use the old version?

有关ES_output_plugin的更多信息，logstash-output-plugin-elasticsearch

如果有人有任何想法，您的份额将是预期的〜

如何查看LogStash发送给Fiddler中的elasticsearch输出的请求？

1 个答案: