문제

I have the following configuration file. But when I run this, I get the timestamp changed in the terminal but the log is not shipped to ElasticSearch.

Here is the configuration file:

input {
stdin {
    type => "stdin-type"
  }
}
filter {

  grok {
    type => "stdin-type"
    patterns_dir=>["./patterns"]
    pattern => "%{PARSE_ERROR}"
    add_tag=>"%{type1},%{type2},%{slave},ERR_SYSTEM"
  }


mutate
{
    type=>"stdin-type"
    replace => ["@message", "%{message}" ]
replace =>["@timestamp","2013-05-09T05:19:16.876Z"]

}


}
output {
  stdout { debug => true debug_format => "json"}
  elasticsearch
{
}
}

On removing the replace line, the log gets shipped. Where am I going wrong?

도움이 되었습니까?

해결책

Run logstash with the verbose flags, and then check your logstash log for any output. In verbose mode, the logstash process usually confirms if the message was sent off to ES or why it wasn't.

Your config looks clean...if the verbose flags don't give you any meaningful output, then you should check your ES setup.

다른 팁

Try the second 'replace' in a second mutate code block.

mutate
{
    type=>"stdin-type"
    replace => ["@message", "%{message}" ]
}
mutate
{
    type=>"stdin-type"
    replace =>["@timestamp","2013-05-09T05:19:16.876Z"]

}
라이센스 : CC-BY-SA ~와 함께 속성
제휴하지 않습니다 StackOverflow
scroll top