Question

我正在使用ELK 5.0.1和Kafka 0.10.1.0。我不知道为什么我的日志不转发我安装Kafkacat并且成功地能够从安装了Kafka集群的所有3台服务器生成和使用日志。

shipper.conf

input {
    file {
            start_position => "beginning"
            path => "/var/log/logstash/logstash-plain.log"
            }
}

 output {
 kafka {
    topic_id => "stash"
    bootstrap_servers  => "<i.p1>:9092,<i.p2>:9092,<i.p3>:9092"
  }
}

receiver.conf

input {
kafka {
        topics => ["stash"]
        group_id => "stashlogs"
        bootstrap_servers  => "<i.p1>:2181,<i,p2>:2181,<i.p3>:2181"

}
}

 output {
    elasticsearch {
       hosts => ["<eip>:9200","<eip>:9200","<eip>:9200"]
       manage_template => false
       index => "logstash-%{+YYYY.MM.dd}"
  }
 }

日志：在logstash-plain.log

中获取以下警告

[2017-04-17T16:34:28,238][WARN ][org.apache.kafka.common.protocol.Errors] Unexpected error 
code: 38.
[2017-04-17T16:34:28,238][WARN ][org.apache.kafka.clients.NetworkClient] Error while fetching 
metadata with correlation id 44 : {stash=UNKNOWN}

Answer 1

看起来您的引导服务器正在使用zookeeper端口。尝试使用Kafka端口（默认为9092）

Logstash不通过Kafka将日志转发到ES

1 个答案: