logstash 配置执行弹性搜索命令

Question

我正在通过主机 ubuntu 16.04 在 3 个 docker 容器中运行 ELK 堆栈 问题是在配置 logstash.conf 文件以执行“ifconfig”或“netstat -ano”之类的命令后出现错误。我的 logstash.conf 文件是：

input {
  exec {
  
    command => "netsat -ano"
    codec => "json"
    interval => 5
  }
}
output{
  elasticsearch { hosts => ["elasticsearch:9200"]}
}
 i get this error after entering this command ( docker run -h logstash --name logstash --link elasticsearch:elasticsearch -it --rm -v "$PWD":/config-dir logstash -f /config-dir/logstash1.conf)

14:29:30.703 [[main]<exec] ERROR logstash.inputs.exec - Error while running command {:command=>"netsat -ano", :e=>#<IOError: Cannot run program "netsat" (in directory "/"): error=2, No such file or directory>, :backtrace=>["org/jruby/RubyIO.java:4380:in `popen'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-exec-3.1.2/lib/logstash/inputs/exec.rb:76:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-exec-3.1.2/lib/logstash/inputs/exec.rb:75:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-exec-3.1.2/lib/logstash/inputs/exec.rb:40:in `inner_run'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-exec-3.1.2/lib/logstash/inputs/exec.rb:34:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:443:in `inputworker'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:436:in `start_input'"]}

谁能帮忙，请提前谢谢！

Answer 1

您需要为这些命令提供完整路径，因为运行 Logstash 的命令不包含这些目录。

input {
  exec {
    command => "/bin/netsat -ano"
    codec => "json"
    interval => 5
  }

}