Logstash 服务找不到我的 json 文件

Question

我有一个我无法弄清楚的问题。我也不确定logstash如何因为db_path也可以，所以如果有人可以帮助我理解-我将不胜感激。

我在 RedHat Linux 虚拟机上运行 ELK。如果我在终端中运行 logstash 文件：

sudo /usr/share/logstash/bin/logstash  -f /etc/logstash/conf.d/new.conf 

一切正常，我什至在 kibana 中看到了日志，这真是太棒了。

但是，如果我尝试将其作为服务运行，则所有信息都将在此处停止，并带有信息日志记录选项：

[2022-10-11T22:42:26,668][INFO ][filewatch.observingtail  ][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] START, creating Discoverer, Watch with file and sincedb collections
[2022-10-11T22:42:26,681][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

跟踪日志记录选项给了我这个：

[2022-10-11T23:16:07,000][TRACE][filewatch.discoverer     ][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] discover_files {:count=>0}
[2022-10-11T23:16:07,755][DEBUG][org.logstash.execution.PeriodicFlush][main] Pushing flush onto pipeline.
[2022-10-11T23:16:08,001][DEBUG][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] writing sincedb (delta since last write = 15)
[2022-10-11T23:16:08,001][TRACE][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] sincedb_write: /dev/null (time = 2022-10-11 23:16:08 +0300)
[2022-10-11T23:16:08,001][TRACE][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] non_atomic_write:  {:time=>2022-10-11 23:16:08 +0300}
[2022-10-11T23:16:09,888][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2022-10-11T23:16:09,888][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2022-10-11T23:16:12,755][DEBUG][org.logstash.execution.PeriodicFlush][main] Pushing flush onto pipeline.
[2022-10-11T23:16:14,892][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2022-10-11T23:16:14,892][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2022-10-11T23:16:17,755][DEBUG][org.logstash.execution.PeriodicFlush][main] Pushing flush onto pipeline.
[2022-10-11T23:16:19,896][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ParNew"}
[2022-10-11T23:16:19,896][DEBUG][logstash.instrument.periodicpoller.jvm] collector name {:name=>"ConcurrentMarkSweep"}
[2022-10-11T23:16:22,005][TRACE][filewatch.discoverer     ][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] discover_files {:count=>0}
[2022-10-11T23:16:22,755][DEBUG][org.logstash.execution.PeriodicFlush][main] Pushing flush onto pipeline.
[2022-10-11T23:16:23,006][DEBUG][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] writing sincedb (delta since last write = 15)
[2022-10-11T23:16:23,006][TRACE][filewatch.sincedbcollection][main][08eaaedb6ad66113aed8069a590d6833a9770ddcf4e214fd8b2500e546978c6e] sincedb_write: /dev/null (time = 2022-10-11 23:16:23 +0300)

我猜这意味着它找不到我的 json 文件。并且写入 sincedb（自上次写入后的增量 = 15）价值不 改变。

新的.conf：

input {
file {
path => "/home/mariussur/logstash/c.json"
codec => "json"
sincedb_path => "/dev/null"
start_position => "beginning"
}
}

filter {}

output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["http://***.**.*.**:9200/"]
user => "*******"
password => "*******"
index => "some-tag"
action => "create"
}
}

管道.yml：

- pipeline.id: main
  path.config: "/etc/logstash/conf.d/*.conf"

我尝试将文件的所有权更改为 logstash 用户，但仍然没有运气。 也许有人有类似的问题，可以帮助我。

提前致谢。

M。

Answer 1

从您在此处共享的 logstash 日志中可以看出，您的 logstash 配置“new.conf”没有运行。

[2022-10-11T22:42:26,681][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}