Question

换句话说，当管道无法启动时，如何确保Logstash死掉？

我正在通过5个管道运行Logstash 7.1.1，并使用pipeline-to-pipeline communication互相调用。当启动其中一个管道时发生错误（例如语法错误）时，该错误会被简单地记录下来，很容易被忽略。

将问题简化为2条管道：

[2019-07-04T17:48:47,887][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"7.1.1"}
[2019-07-04T17:48:56,393][ERROR][logstash.plugins.registry] Tried to load a plugin's code, but failed. {:exception=>#<LoadError: no such file to load -- logstash/filters/BADFILTER>, :path=>"logstash/filters/BADFILTER", :type=>"filter", :name=>"BADFILTER"}
[2019-07-04T17:48:56,423][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:myid, :exception=>"LogStash::PluginLoadingError", :message=>"Couldn't find any filter plugin named 'BADFILTER'. Are you sure this is correct? Trying to load the BADFILTER filter plugin resulted in this error: no such file to load -- logstash/filters/BADFILTER", :backtrace=>["/opt/logstash/logstash-core/lib/logstash/plugins/registry.rb:211:in `lookup_pipeline_plugin'", "/opt/logstash/logstash-core/lib/logstash/plugin.rb:137:in `lookup'", "org/logstash/plugins/PluginFactoryExt.java:200:in `plugin'", "org/logstash/execution/JavaBasePipelineExt.java:50:in `initialize'", "/opt/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:in `initialize'", "/opt/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]}
[2019-07-04T17:48:58,313][INFO ][logstash.javapipeline    ] Starting pipeline {:pipeline_id=>"myid2", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>1000, :thread=>"#<Thread:0x357de3fe@/opt/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:37 run>"}
[2019-07-04T17:48:58,412][INFO ][logstash.javapipeline    ] Pipeline started {"pipeline.id"=>"myid2"}
[2019-07-04T17:49:00,440][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}

在此示例中，管道“ myid”无法启动，因为我使用了不存在的插件BADFILTER，而“ myid2”开始正常。然后，该过程将继续运行，并且不会失败。

如果Logstash无法启动管道，我该如何配置它死掉？后续问题，如果成功启动后出现错误（例如，失去与弹性的连接），如何使Logstash死亡？

Answer 1

这是Logstash与多个管道一起运行时的工作方式，如果至少一个管道正确，则无论某些管道是否发生故障，logstash进程都会运行，并且如果启用了自动重新加载功能，它将继续尝试重新启动失败的管道。 / p>

如果要在其中一个管道发生故障时停止Logstash，则只需要使用一个管道并使用标签和条件过滤数据，这是在引入管道之前运行多个管道的方法。选项。

Answer 2

您可以在标准输出中应用您需要的正则表达式（例如：终止）：

logstash | while read line ; do if [[ ${line} =~ terminated ]]; then $(kill -TERM $(pgrep -u logstash)); fi ; done

对于我的 docker 测试，我运行了类似的东西：

docker run docker.elastic.co/logstash/logstash:7.10.1 /bin/bash -c 'sleep 2 && time logstash 2>&1 | while read line ; do if [[ ${line} =~ terminated ]]; then $(kill -TERM $(pgrep -u logstash)); fi ; done'

Docker上的Logstash即使管道发生故障也可以继续运行

2 个答案: