Question

我使用logstash解析文件并将其存储在mongodb中。如果刚刚重命名文件，我不希望logstash重新解析文件。我怎样才能实现这一目标？我包含了sincedp_path字段，我的命令是这样的。

input {
    file {
        path => "/file.log"
        sincedb_path => "/logstash"
    }
}
output {
    mongodb {
        collection ="collect" database => "db" uri => "mongodb://localhost"
    }
}

这会出现以下错误：

A plugin had an unrecoverable error. Will restart this plugin.
Error: Permission denied - /logstash.13562.1005.292789 or /logstash            {:level=>:error}
Errno::EACCES: Permission denied - /logstash.13562.1005.545871 or /logstash
      rename at org/jruby/RubyFile.java:987
atomic_write at /logstash/vendor/bundle/jruby/1.9/gems/filewatch-    0.6.4/lib/filewatch/helper.rb:39
_sincedb_write at /logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.4/lib/filewatch/tail.rb:236
sincedb_write at /logstash/vendor/bundle/jruby/1.9/gems/filewatch-0.6.4/lib/filewatch/tail.rb:206
teardown at /logstash/vendor/bundle/jruby/1.9/gems/logstash-input-file-1.0.0/lib/logstash/inputs/file.rb:157
inputworker at /logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/pipeline.rb:203
synchronize at org/jruby/ext/thread/Mutex.java:149
inputworker at /logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/pipeline.rb:203
start_input at /logstash/vendor/bundle/jruby/1.9/gems/logstash-core-1.5.3-java/lib/logstash/pipeline.rb:171

我该如何解决这个问题？

Answer 1

logstash的默认行为是通过sincedb中的inode跟踪文件。这将处理正确重命名的文件。如果您遇到它不起作用，那么很可能您的sincedb被设置为logstash无法写入的目录/文件。你可以明确地说出你的sincedb：http://logstash.net/docs/1.4.2/inputs/file#sincedb_path

file {
  sincedb_path  => '/some/writable/directory'
}

如果刚刚重命名，则Logstash会重新分析文件

1 个答案: