Question

这里的细节

Sending Logstash's logs to /data/logs/logstash which is now configured via log4j2.properties
SLF4J: Class path contains multiple SLF4J bindings.
SLF4J: Found binding in [jar:file:/root/.m2/repository/org/apache/logging/log4j/log4j-slf4j-impl/2.6.2/log4j-slf4j-impl-2.6.2.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: Found binding in [jar:file:/usr/share/logstash/vendor/bundle/jruby/1.9/gems/march_hare-3.0.0-java/lib/ext/slf4j-simple.jar!/org/slf4j/impl/StaticLoggerBinder.class]
SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
SLF4J: Actual binding is of type [org.apache.logging.slf4j.Log4jLoggerFactory]
[FATAL] 2018-04-23 09:55:02.267 [LogStash::Runner] runner - An unexpected error occurred! {:error=>#<NoMethodError: undefined method `tr' for 7.9393e-05:Float>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.3.1/lib/logstash/filters/mutate.rb:344:in `convert_float'", "org/jruby/RubyMethod.java:120:in `call'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.3.1/lib/logstash/filters/mutate.rb:313:in `convert'", "org/jruby/RubyHash.java:1342:in `each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.3.1/lib/logstash/filters/mutate.rb:299:in `convert'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.3.1/lib/logstash/filters/mutate.rb:252:in `filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in `do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in `multi_filter'", "org/jruby/RubyArray.java:1613:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in `multi_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:46:in `multi_filter'", "(eval):260901:in `initialize'", "org/jruby/RubyArray.java:1613:in `each'", "(eval):260896:in `initialize'", "org/jruby/RubyProc.java:281:in `call'", "(eval):21701:in `filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:398:in `filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:379:in `worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:342:in `start_workers'"]}
The signal INT is in use by the JVM and will not work correctly on this platform
[2018-04-23 09:55:02.282] ERROR -- undefined method `tr' for 7.7963e-05:Float: nil

不能在这里弄错了。

我的数据源是rabbitMQ队列

一切都还行，直到今天早上5.6.9升级。

Answer 1

我在这里找到了解决方案 https://github.com/StamusNetworks/SELKS/issues/112

我认为这是由于https://www.elastic.co/guide/en/logstash/5.6/logstash-5-6-9.html

Mutate Filter

修复：使用小数逗号（例如1,23）的数字字符串，添加转换   支持指定integer_eu和float_eu。功能：添加大写   特征

现在它在插件降级后起作用

usr/share/logstash# bin/logstash-plugin install --version 3.2.0 logstash-filter-mutate

Logtash：未定义的方法tr

1 个答案: