Question

我正在尝试使用kibana elasticsearch和logstash添加apache的日志。但是logstash并未为elastticsearch创建索引，因此我无法在kibana中可视化数据这是我的docker-compose：

 elasticsearch:                                                  
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.2.4
    container_name: elasticsearch  
    hostname: elasticsearch         
    environment:                          
      - cluster.name=docker-cluster         
      - bootstrap.memory_lock=true           
      - ES_JAVA_OPTS=-Xms512m -Xmx512m    
      - http.cors.enabled=true
      - http.cors.allow-origin= "*"
    ulimits:                                 
      memlock:                                      
        soft: -1                                    
        hard: -1                                    
    volumes:                                         
      - esdata1:/usr/share/elasticsearch/data        
    ports:                                           
      - 9200:9200  
  logstash:
    image: docker.elastic.co/logstash/logstash-oss:6.2.4
    restart: unless-stopped
    depends_on:
      - elasticsearch
    volumes:
     - ./logstash-apache.conf:/opt/logstash/logstash-apache.conf
     - ./logs:/logs/access_log
    links:
      - elasticsearch
    command: logstash -f /opt/logstash/logstash-apache.conf                                                             
  kibana:                                            
    image: docker.elastic.co/kibana/kibana-oss:6.2.4 
    container_name: kibana    
    volumes:                                 
      - esdata2:/usr/share/kibana/config/data
    ports:          
     - 5601:5601                              
    depends_on:                                      
     - elasticsearch        
    links:
      - elasticsearch  
volumes:                                     
  esdata1:                                   
    driver: local                            
  esdata2:                                   
    driver: local

这是我的Logstash-apache.conf

input {
  file {
    type => "apache_access"
    path => "/var/log/httpd/access_log"
    start_position => beginning

  }
}
filter {
  if [type] == "apache_access" {
    grok {
      match => { "message" => "%{COMBINEDAPACHELOG}( \*\*%{POSINT:responsetime}\*\*)?" }
    }
    date {
      match => [ "timestamp" , "dd/MMM/yyyy:HH:mm:ss Z" ]
    }
 }
}
output {
  elasticsearch {
    hosts =>  ["elasticsearch:9200"]
    index => "apache_logstash-%{+YYYY.MM.dd}"
  }
}

这是输出消息：

logstash_1| [2018-07-18T23:55:25,926][INFO ][logstash.agent] Pipelines running {:count=>1, :pipelines=>["main"]}

我的输出没有错误，但是logstash没有产生数据的问题我该怎么办？有人可以帮我吗？

虽然管道主启动，但Logstash不会产生输出

0 个答案: