Logstash不读取“文件”输入

时间:2017-10-27 13:33:03

标签: elasticsearch logstash

我正在尝试使用file作为logstash的输入。这是我的logstash.conf

input {
     file {
          path => "/home/dxp/elb.log"
          type => "elb"
          start_position => "beginning"
          sincedb_path => "/home/dxp/log.db"
          }
    }

        filter {
        if [type] == "elb" {
                grok {
                    match => [ "message", "%{TIMESTAMP_ISO8601:timestamp} %{NOTSPACE:loadbalancer} %{IP:client_ip}:%{NUMBER:client_port:int} %{IP:backend_ip}:%{NUMBER:backend_port:int} %{NUMBER:request_processing_time:float} %{NUMBER:backend_processing_time:float} %{NUMBER:response_processing_time:float} %{NUMBER:elb_status_code:int} %{NUMBER:backend_status_code:int} %{NUMBER:received_bytes:int} %{NUMBER:sent_bytes:int} %{QS:request}" ]
                }
            }
        }
        output
        {
          elasticsearch {
               hosts => "10.99.0.180:9200"
               manage_template => false
               index => "elblog-%{+YYYY.MM.dd}"
               document_type => "%{[@metadata][type]}"
           }
        }

我的日志显示: [2017-10-27T13:11:31,164][DEBUG][logstash.inputs.file ]_globbed_files: /home/dxp/elb.log: glob is []:我想我的文件还没有被logstash读取,所以在elasticsearch中没有形成新的索引。  请帮助我解决这个问题。

0 个答案:

没有答案