Question

我正在尝试在Logstash中创建一个syslog转发器，它将读取syslog消息（或其他格式），并输出syslog。

这是我的输出配置：

output {
    stdout { debug => true debug_format => "json"}
    syslog {
        appname => "gulfstream"
        facility => "daemon"
        host => "127.0.0.1"
        port => "514"
        protocol => "tcp"
        severity => "%{severity}"
    }
}

这是一个示例日志消息：

{"@source":"file://ubuntu/etc/nbase/gs-switch-1/g150.log","@tags":[],"@fields":{"severity":["error"],"message":["eb3|9ac47fc nbstub.py:_refresh_socket 5 abxc"]},"@timestamp":"2013-05-14T18:35:13.095Z","@source_host":"ubuntu","@source_path":"/etc/nbase/gs-switch-1/g150.log","@message":"E 2013-05-13 16:47:15,1265 eb3|9ac47fc nbstub.py:_refresh_socket 5 abxc","@type":"gs-switch"}

请注意"@fields":{"severity"}部分。我还尝试了severity => %{@fields.severity}和%{severity}，但在所有情况下我都收到错误：

Invalid setting for syslog output plugin:

  output {
    syslog {
      # This setting must be a ["emergency", "alert", "critical", "error", "warning", "notice", "informational", "debug"]
      # Expected one of ["emergency", "alert", "critical", "error", "warning", "notice", "informational", "debug"], got ["%{@message}"]
      severity => ["%{severity}"]
      ...
    }
  } {:level=>:error}

有谁可以指出我做错了什么？

Answer 1

我认为您目前正在寻求的功能尚未实现。我可以看到它的必要性，并添加了一张入场券。请点击LOGSTASH-1090

在logstash输出中使用生成的字段

1 个答案: