ELK:启动logstash失败,非法状态异常

时间:2018-06-20 13:57:55

标签: elasticsearch logstash

由于我的服务器无法访问互联网。我下载了filebeat,logstash,elasticsearch和kibana的rpm格式文件。

我使用命令SELECT e.id AS eid, p.dscr AS jdscr, e.startdate AS hdate, Concat(e.fname,e.lname) AS NAME, m.weekenddate AS weekenddate m.bramt AS bramt, m.conamt AS conamt, w.twork AS twork FROM tblemp e LEFT JOIN ( SELECT cid, weekenddate, COALESCE(( CASE WHEN mrtype = 'BR' THEN sum(mgamt) END),0) AS bramt , COALESCE(( CASE WHEN mrtype = 'con' THEN sum(mgamt) END),0) AS conamt FROM mngrtbl GROUP BY cid, weekendate, mrtype) m ON e.id = m.cid LEFT JOIN ( SELECT emp, sum(twork) AS twork FROM tblans GROUP BY emp) w ON e.id = w.emp LEFT JOIN pname p ON e.pid = p.ponid 安装rpm -Uvh xxx.rpm。然后,我修改了配置。对于logstash,我更新了filebeat logstash elasticsearch and kibana并将其复制到pipelines.yml目录。

piplelines.yml如下:

/etc/logstash/conf.d

从/ var / log /中,我可以看到filebeat,elasticsearch很好。但是在logstash的logstash-plain.log中,有错误消息:

input {
  beats {
    port => "5044"
    }
}
filter {
  grok {
    match => {
      "message" => [
                "%{TIMESTAMP_ISO8601:timestamp} \[%{DATA:threadname}\] - %{LOGLEVEL:loglevel} - app-info-exception-info - params:%{SPACE}\{\"%{DATA:jsondata}\"\} %{DATA:excentionname}: %{DATA:exceptiondetail}\n(?m)%{GREEDYDATA:extralines}",
                "(?<timestamp>[\d\-\s\:]+)\s\[(?<threadname>[\d\.\w\s\(\)\-]+)\]\s-\s(?<loglevel>[\w]+)\s+-\s(?<appinfo>app-info)\s-\s(?<systemmsg>[\w\d\:\{\}\,\-\(\)\s\"]+)",
                "(?<timestamp>[\d\-\s\:]+)\s\[(?<threadname>[\d\.\w\s\(\)\-]+)\]\s-\s(?<loglevel>[\w]+)\s+-\s+(?<systemmsg>[\s\.\w\-\'\:\d\[\]\/]+)"
                        ]
        }
  }
}
output {
  #stdout { codec => rubydebug }
  elasticsearch {
    hosts => [ "localhost:9200" ]
    index => "ykt"
  }
}

在更新yml /配置后,我愿意

[2018-06-20T20:21:54,138][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[2018-06-20T20:22:07,642][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[2018-06-20T20:22:21,299][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[2018-06-20T20:22:34,572][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[2018-06-20T20:22:48,019][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit 

我不为什么会出现非法状态异常。有帮助吗?

0 个答案:

没有答案