我想设置Logstash来读取应用程序输出的日志文件。在这一点上，我只是试图使其与一个小的应用程序一起工作，该应用程序每5s只需写入一次文件。然后的目标是通过网络传输线，但是对于这个简单的测试，我将输出配置为另一个文件。
这是我的Logstash配置：
input {
file {
path => "D:\temp\logstash-input.txt"
mode => "tail"
codec => line
start_position => "beginning"
}
# An input which works, added to confirm that it's not the output that's a problem
http {
port => 1234
}
}
output {
file {
path => "D:\temp\logstash-output.txt"
codec => line
}
}
这是C＃中的测试程序：
static void Main(string[] args)
{
var stopwatch = new Stopwatch();
stopwatch.Start();
while (true)
{
using (var writer = File.AppendText(@"D:\temp\logstash-input.txt"))
{
writer.WriteLine($"{stopwatch.Elapsed.TotalSeconds:F1}s closer to the end of the universe.");
}
Thread.Sleep(TimeSpan.FromSeconds(5));
}
}
该应用程序每5秒成功写入一次logstash-input.txt，这在文本编辑器中可以看到。但是，Logstash不会将这些行复制到logstash-output.txt。没有任何内容输出到运行Logstash的命令行窗口。
我添加了第二个HTTP输入，只是为了确保问题出在文件输入而不是输出上。 Logstash可正确写入我用邮递员发到端口1234的logstash-output.txt条消息。因此文件 output 很好。
我尝试清除Logstash创建的sincedb文件以跟踪其在文件中的位置，为此我根据发现的其他建议为该测试添加了start_position => "beginning"，但这些都不起作用。
有什么我想念的吗？
我正在Windows 10和OpenJDK 13上运行Logstash 7.4.0。
这是Logstash打印到命令行窗口的完整输出。我在那里看不到任何有价值的东西，没有明显的错误，但也许我缺少了一些东西。
OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release.
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by com.headius.backport9.modules.Modules (file:/D:/programs/logstash-7.4.0/logstash-core/lib/jars/jruby-complete-9.2.8.0.jar) to field java.io.FileDescriptor.fd
WARNING: Please consider reporting this to the maintainers of com.headius.backport9.modules.Modules
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
Thread.exclusive is deprecated, use Thread::Mutex
Sending Logstash logs to D:/programs/logstash-7.4.0/logs which is now configured via log4j2.properties
[2019-10-10T13:25:35,728][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-10-10T13:25:35,742][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.4.0"}
[2019-10-10T13:25:37,268][INFO ][org.reflections.Reflections] Reflections took 38 ms to scan 1 urls, producing 20 keys and 40 values
[2019-10-10T13:25:38,016][WARN ][org.logstash.instrument.metrics.gauge.LazyDelegatingGauge][main] A gauge metric of an unknown type (org.jruby.RubyArray) has been create for key: cluster_uuids. This may result in invalid serialization. It is recommended to log an issue to the responsible developer/development team.
[2019-10-10T13:25:38,021][INFO ][logstash.javapipeline ][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>1000, :thread=>"#<Thread:0x33627b0d run>"}
[2019-10-10T13:25:38,505][INFO ][logstash.inputs.file ][main] No sincedb_path set, generating one based on the "path" setting {:sincedb_path=>"D:/programs/logstash-7.4.0/data/plugins/inputs/file/.sincedb_b1efb07038fbb620c60dcef403b917a1", :path=>["D:\\temp\\logstash-input.txt"]}
[2019-10-10T13:25:39,099][INFO ][logstash.javapipeline ][main] Pipeline started {"pipeline.id"=>"main"}
[2019-10-10T13:25:39,105][INFO ][logstash.inputs.http ][main] Starting http input listener {:address=>"0.0.0.0:1234", :ssl=>"false"}
[2019-10-10T13:25:39,164][INFO ][filewatch.observingtail ][main] START, creating Discoverer, Watch with file and sincedb collections
[2019-10-10T13:25:39,170][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2019-10-10T13:25:39,445][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}