我的问题很简单,但我找不到解决方案。我有一个logstash和Elasticsearch服务器。一般情况下,我可以通过logstash将日志发送到elasticsearch。
请看下面的代码:logstash.conf文件将日志发送到弹性
input {
file {
type => "json"
path => ["C:/logs/*.json"]
start_position => "beginning"
codec => "json"
}
}
filter {
mutate {
remove_field => [ "path" ]
}
}
output {
stdout {
codec => rubydebug
}
elasticsearch {
hosts => [ "localhost:9200" ]
}
}
但是我在logstash和elasticsearch之间放了一个nginx,我配置了但是它没有用。以下错误返回。
input {
file {
type => "json"
path => ["C:/logs/*.json"]
start_position => "beginning"
codec => "json"
}
}
filter {
mutate {
remove_field => [ "path" ]
}
ruby {
code => "
require 'base64';
event['password'] = bG9ndXNlcjpidXJnYW5iYW5rXzIwMTc=
"
}
}
output {
stdout {
codec => rubydebug
}
http {
http_method => "post"
url => "http://localhost:8080;"
format => "message"
headers => {"Authorization" => "Basic %{password}"}
content_type => "application/json"
message => '{"whatever": 1 }'
}
}
错误:[2017-09-18T11:07:30,235] [错误] [logstash.outputs.http] [HTTP输出失败]遇到非2xx HTTP代码401 {:response_code => 401,:url =&gt ;“http://localhost:8080;”,:event => 2017-09-18T07:05:42.797Z test_y HTTP“EJT \ ANYCUSTOMER”“”“GET”“/ api / v1.0 / xxxxxxx / xxxxx”已回复200 in 0.0000 ms,:will_retry => false}
下面的第二个简单解决方案,但它也不起作用:
input {
file {
type => "json"
path => ["C:/logs/*.json"]
start_position => "beginning"
codec => "json"
}
}
filter {
mutate {
remove_field => [ "path" ]
}
}
output {
stdout {
codec => rubydebug
}
http {
http_method => "post"
url => "http://127.0.0.1:8080"
headers => ["Authorization", "Basic dXNlcjE6JGFwcjEkNGdTY3dwMkckSlBLOXNVRmJGbzZ4UjhnSUVqYXo2Lg=="]
}
}
错误:[错误] [logstash.outputs.http] [HTTP输出失败]遇到非2xx HTTP代码401 {:response_code => 401,:url =>“http://127.0.0.1:8080”,