Question

我想在logstash中使用Filebeat。但是logstash.conf是错误的。

logstash.conf：

```

input {
    beats {
        port => "5044"
    }
}

output {
    elasticsearch {
        hosts => [ "localhost:9200" ]
    }
}

```

它回应了这个：

无法执行操作{：action =＆gt; LogStash :: PipelineAction :: Create / pipeline_id：main，：exception =＆gt;“LogStash :: ConfigurationError”，：message =＆gt;“预期的＃，输入，过滤器，在第3行，第1列（字节76）之后输出“，：backtrace =＆gt; [”/ opt / logstash / logstash-core / lib / logstash / compiler.rb：42：in compile_imperative'", "/opt/logstash/logstash-core/lib/logstash/compiler.rb:50:in compile_graph' “，”/ opt / logstash / logstash-core / lib / logstash / compiler.rb：12：in block in compile_sources'", "org/jruby/RubyArray.java:2486:in map'“，”/ opt / logstash / logstash-core / lib / logstash / compile.rb： 11：在compile_sources'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:51:in初始化'“，”/ opt / logstash / logstash-core / lib / logstash / pipeline.rb：171：initialize'", "/opt/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in执行'“，”/ opt / logstash / logstash- core / lib / logstash / agent.rb：335：在block in converge_state'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:141:in with_pipelines'“，”/ opt / logstash / logstash-core / lib / logstash / agent.rb：332：block in converge_state'", "org/jruby/RubyArray.java:1734:in每个' “，”/ opt / logstash /logstash-core / lib / logstash / agent.rb：31：在converge_state'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:166:in块中的converge_state_and_update'“，”/ opt / logstash / logstash-core / lib / logstash / agent。 rb：141：在with_pipelines'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:164:in converge_state_and_update'“，”/ opt / logstash / logstash-core / lib / logstash / agent.rb：90：execute'", "/opt/logstash/logstash-core/lib/logstash/runner.rb:343:in块中执行'“，”/ opt / logstash /vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in“block in initialize'”]}

Answer 1

beats插件是错误的。端口应该是一个数字。

https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html

你也没有过滤插件，也许这也是必要的：

input {
    beats {
        port => 5044
    }
}
filter{}
output {
    elasticsearch {
        hosts => [ "localhost:9200" ]
    }
}

ELK-logstash.conf总是错误的

1 个答案: