使用logstash时,我看到这样的错误:
[2019-03-14T12:59:39,516][WARN ][logstash.codecs.plain ]
Received an event that has a different character encoding than you configured.
{
:text=>"08/02/2019 22:45:06 || : Service Reglement, ValiderReglementBilling:Echec de validation de r\\xE9glement dans NaviBilling. Transaction N\\xB0: 20194160773This message is for C/AL programmers: The call to member CreationFacture failed: Input string was not in a correct format..\\r",
:expected_charset=>"UTF-8"
}
我不知道正确的事件格式应使用哪种编解码器?问题出在主题领域。
我的logstash.conf是:
input {
file {
path => "D:\ELK\log\WCF-08-02-2019-7e8b53db-Error.log"
start_position => "beginning"
}
filter {
grok {
match => {
"message" => ["%{DATESTAMP:time} \|\| :%{DATA:Name_Service}:%{DATA:Action}: %{GREEDYDATA:Gravity}",
"%{DATESTAMP:time} \|\| :%{DATA:Name_Service},%{DATA:Action}: %{GREEDYDATA:Gravity}",
"%{DATESTAMP:time} \|\| :%{DATA:Name_Service}, %{DATA:Action}: %{GREEDYDATA:Gravity}"
]
}
}
}
output {
elasticsearch {
action => "index"
hosts => "http://localhost:9200"
index => "logstash-pfe2-%{+YYYY.MM.dd}"
}
}