Question

我是ELK堆栈的新手。想要使用从filebeat到logstash的管道来推送数据，这样就可以将数据推送到弹性数据库。我的配置如下：

input {
beats {
    port => "5043"
  }
}

filter {
  grok {
match => { "message" => "\A%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{WORD:var0}%{SPACE}%{NOTSPACE}%{SPACE}(?<searchinfo>[^#]*)#(?<username>[^#]*)#(?<searchQuery>[^#]*)#(?<latitude>[^#]*)#(?<longitude>[^#]*)#(?<client_ip>[^#]*)#(?<responseTime>[^#]*)" }
  }
}


output {
     stdout { codec => rubydebug }
        elasticsearch {
            index => "logstash_logs"
            document_type => "logs"
            hosts => [ "localhost:9200" ]
}

问题是当我做bin/logstash -f first-pipeline.conf --config.test_and_exit时。它引发了一个错误陈述：

17:55:37.691 [LogStash::Runner] FATAL logstash.runner - The given configuration is invalid. Reason: Expected one of #, if, ", ', } at line 22, column 1 (byte 487) after output {
stdout { codec => rubydebug }
    elasticsearch {
        index => "logstash_logs"
        document_type => "logs"
        hosts => [ "localhost:9200" ]
}

任何人都可以指出我哪里出错了吗？

Answer 1

您在output { stdout { codec => rubydebug } elasticsearch { index => "logstash_logs" document_type => "logs" hosts => [ "localhost:9200" ] } <--- this is missing }输出

中缺少结束大括号

var mainContainer = new FreshMasterDetailNavigationContainer(NavigationContainerNames.MainContainer);
        mainContainer.Init("Menu");
        mainContainer.AddPage<ActivityFeedListPageModel>("ActivityFeed", new User());
        mainContainer.AddPage<ProfilePageModel>("Profile", new User());
        App.Current.MainPage = mainContainer;

Logstash配置错误

1 个答案: