Question

您好我正在尝试设置ELK服务器以进行日志管理。我的logstash服务运行正常。我从其他机器接收日志但是logstash管道无法将数据发送到弹性搜索
当我查看logstash .log文件时，它显示此错误我无法识别配置文件中的错误

:message=>"Error: Expected one of #, input, filter, output at line 34, column 1 (byte 855) after ", :level=>:error}

我的logstash / conf.d

input {
beats {
port => 5044
ssl => true
ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl_key => "/etc/pki/tls/private/logstash-forwarder.key"
}
}
filter {
if [type] == "syslog" {
grok {
  match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
  add_field => [ "received_at", "%{@timestamp}" ]
  add_field => [ "received_from", "%{host}" ]
}
    syslog_pri { }
    date {
  match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
sniffing => true
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
{
"mappings": {
"_default_": {
  "_all": {
    "enabled": true,
    "norms": {
      "enabled": false
    }
  },
  "dynamic_templates": [
    {
      "template1": {
        "mapping": {
          "doc_values": true,
          "ignore_above": 1024,
          "index": "not_analyzed",
          "type": "{dynamic_type}"
        },
  "match": "*"
      }
    }
  ],
  "properties": {
    "@timestamp": {
      "type": "date"
    },
    "message": {
      "type": "string",
      "index": "analyzed"
    },
    "offset": {
      "type": "long",
      "doc_values": "true"
    },
    "geoip"  : {
      "type" : "object",
      "dynamic": true,
      "properties" : {
        "location" : { "type" : "geo_point" }
      }
    }
  }
}
},
"settings": {
"index.refresh_interval": "5s"
 },
"template": "filebeat-*"
}

Answer 1

当/etc/logstash/conf.d目录中有logstash无法解析的文件时，会发生此错误。删除它们，看看这是否有帮助。就我而言，当在conf.d目录中显示reports.xml文件时，我遇到了同样的错误。

错误：在logstash中{：level =＆gt;：error}之后的第34行，第1列（第1列）中的＃，input，filter，output之一

1 个答案: