Question

我有这些日志：

2019-04-01 12:45:33.207 ERROR [validator,,,] 1 --- [tbeatExecutor-0] com.netflix.discovery.DiscoveryClient    : DiscoveryClient_VALIDATOR/e5d3dc665009:validator:8789 - was unable to send heartbeat!

com.netflix.discovery.shared.transport.TransportException: Retry limit reached; giving up on completing the request
    at com.netflix.discovery.shared.transport.decorator.RetryableEurekaHttpClient.execute(RetryableEurekaHttpClient.java:138) ~[eureka-client-1.4.12.jar!/:1.4.12]
    at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89) ~[eureka-client-1.4.12.jar!/:1.4.12]
    at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator$3.execute(EurekaHttpClientDecorator.java:92) ~[eureka-client-1.4.12.jar!/:1.4.12]
    at com.netflix.discovery.shared.transport.decorator.SessionedEurekaHttpClient.execute(SessionedEurekaHttpClient.java:77) ~[eureka-client-1.4.12.jar!/:1.4.12]
    at com.netflix.discovery.shared.transport.decorator.EurekaHttpClientDecorator.sendHeartBeat(EurekaHttpClientDecorator.java:89) ~[eureka-client-1.4.12.jar!/:1.4.12]
    ...

我想将所有这些行合并到同一行，所以我在logstash中使用了此输入：

input {
    tcp {
        port => 5002
        codec => json
        codec => multiline {
            pattern => "^%{TIMESTAMP_ISO8601}"
            negate => true
            what => previous
        }
        type => "logspout-logs-tcp"
    }
}

但是它不起作用，我不知道它是否是由于第二行上的空行，如果是，我该如何解决此问题？我正在使用Logstash版本5.6.14。

Answer 1

Please check the below code,

input {
        tcp {
            port => 5002
            codec => multiline {
            pattern => "^%{TIMESTAMP_ISO8601}"
            negate => true
            what => "previous"
            }
            type => "logspout-logs-tcp"
        }
    }

Logstash多行插件不适用于空行

1 个答案: