Question

在centos 7上使用logstash 2.3.4-1和kafka-input插件我有时会得到

{：timestamp =＆gt;＆＃34; 2016-09-07T13：41：46.437000 + 0000＆＃34;，：message =＆gt;＃0，：events_consumed =＆gt; 822，：worker_count =＆gt; 1，：inflight_count =＆gt; 0，：worker_states =＆gt; [{：status =＆gt;＆＃34; dead＆＃34;，：alive =＆gt; false，：index =＆gt; 0，：inflight_count =＆gt; 0}] ，：output_info =＆gt; [{：type =＆gt;＆＃34; http＆＃34;，：config =＆gt; {＆＃34; http_method＆＃34; =＆gt;＆＃34; post＆＃34;，＆＃ 34; url＆＃34; =＆gt;＆＃34; $ {APP_URL} /＆＃34;，＆＃34;标题＆＃34; =＆gt; [＆＃34; AUTHORIZATION＆＃34;，＆＃34;基本$ {CREDS}＆＃34;]，＆＃34; ALLOW_ENV＆＃34; =＆gt; true}，：is_multi_worker =＆gt; false，：events_received =＆gt; 0，：workers =＆gt;＆＃34;＆＃34; ，headers =＆gt; {..}，codec =＆gt;＆＃34; UTF-8＆＃34;＆gt;，workers =＆gt; 1，request_timeout =＆gt; 60，socket_timeout =＆gt; 10，connect_timeout =＆gt; 10 ，follow_redirects =＆gt; true，pool_max =＆gt; 50，pool_max_per_route =＆gt; 25，keepalive =＆gt; true，automatic_retries =＆gt; 1，retry_non_idempotent =＆gt; false，validate_after_inactivity =＆gt; 200，ssl_certificate_validation =＆gt; true，keystore_type =＆gt;＆＃34; JKS＆＃34;，truststore_type =＆gt;＆＃34; JKS＆＃34; ，cookies =＆gt; true，verify_ssl =＆gt; true，format =＆gt;＆＃34; json＆＃34;＆gt;]＆gt;，：busy_workers =＆gt; 1}，{：type =＆gt;＆＃34; stdout＆＃34;，：config =＆gt; {＆＃34; ALLOW_ENV＆＃34; =＆gt; true}，：is_multi_worker =＆gt; false，：events_received =＆gt; 0，：workers =＆gt;＆＃34; \ n＆＃ 34;＆gt;，workers =＆gt; 1＆gt;]＆gt;，：busy_workers =＆gt; 0}]，：thread_info =＆gt; []，：stalling_threads_info =＆gt; []}＆gt;，：level =＆gt;：warn }

这是配置

        input {
      kafka {
        bootstrap_servers => "${KAFKA_ADDRESS}"
        topics => ["${LOGSTASH_KAFKA_TOPIC}"]
      }
    }

    filter {
      ruby {
        code =>
      "require 'json'
       require 'base64'

       def good_event?(event_metadata)
         event_metadata['key1']['key2'].start_with?('good')
       rescue
         true 
       end

       def has_url?(event_data)
         event_data['line'] && event_data['line'].any? { |i| i['url'] && !i['url'].blank? }
       rescue
         false
       end

       event_payload = JSON.parse(event.to_hash['message'])['payload']

       event.cancel unless good_event?(event_payload['event_metadata'])
       event.cancel unless has_url?(event_payload['event_data'])
    "
  }
    }

    output {
      http {
          http_method => 'post'
          url => '${APP_URL}/'
          headers => ["AUTHORIZATION", "Basic ${CREDS}"]
      }

      stdout { }
    }

这很奇怪，因为它写入logstash.log而不是logstash.err

这个错误意味着什么，我该如何避免？（只有重新启动logstash解决它，直到下一次发生）

Answer 1

根据this github issue，您的ruby代码可能会导致问题。基本上任何ruby异常都会导致过滤器工作者死亡。在没有看到ruby代码的情况下，无法进一步调试，但是您可以尝试将ruby代码包装在异常处理程序中并在某处记录异常（至少在更新logstash以记录它之前）。

Logstash工作者无缘无故地死去

1 个答案: