logstash 错误 syslog udp_listener 死了答案

【问题标题】：logstash error syslog udp_listener diedlogstash 错误 syslog udp_listener 死了
【发布时间】：2014-03-26 19:07:36
【问题描述】：

必须将以下部分添加到 /System/Library/LaunchDaemons/com.apple.syslogd.plist 以在端口 514 上为 syslogd 激活 udp

<key>NetworkListener</key>
<dict>
<key>SockServiceName</key>
<string>syslog</string>
<key>SockType</key>
<string>dgram</string>
</dict>

/etc/services 有条目

shell           514/tcp     # cmd
syslog          514/udp # 
syslog-conn     601/udp     # Reliable Syslog Service
syslog-conn     601/tcp     # Reliable Syslog Service

运行 logstash-1.4.0/bin/logstash -f logstash-syslog.conf 给出：

syslog tcp listener died {:address=>"0.0.0.0:514", :exception=>#<Errno::EACCES: Permission denied - bind(2)>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:124:in `initialize'", "org/jruby/RubyIO.java:852:in `new'", "/Users/priyankb/Documents/logstash-1.4.0/lib/logstash/inputs/syslog.rb:135:in `tcp_listener'", "/Users/priyankb/Documents/logstash-1.4.0/lib/logstash/inputs/syslog.rb:90:in `run'"], :level=>:warn}

使用 sudo 运行它会得到：

syslog udp listener died {:address=>"0.0.0.0:514", :exception=>#<SocketError: bind: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyUDPSocket.java:160:in `bind'", "/Users/priyankb/Documents/logstash-1.4.0/lib/logstash/inputs/syslog.rb:116:in `udp_listener'", "/Users/priyankb/Documents/logstash-1.4.0/lib/logstash/inputs/syslog.rb:76:in `run'"], :level=>:warn}

sudo lsof -ni -P | grep -i 514的输出

launchd     1           root   25u  IPv4 0x4ec86f4f62c22bb5      0t0    UDP *:514
launchd     1           root   26u  IPv6 0x4ec86f4f746ca4f5      0t0    UDP *:514
mDNSRespo  47 _mdnsresponder   49u  IPv4 0x4ec86f4f62c1faf5      0t0    UDP *:51446
mDNSRespo  47 _mdnsresponder   50u  IPv6 0x4ec86f4f62c1f2d5      0t0    UDP *:51446
mDNSRespo  47 _mdnsresponder   58u  IPv4 0x4ec86f4f63fd7175      0t0    UDP *:51437
mDNSRespo  47 _mdnsresponder   59u  IPv6 0x4ec86f4f62c1f475      0t0    UDP *:51437
syslogd   655           root    6u  IPv4 0x4ec86f4f62c22bb5      0t0    UDP *:514
syslogd   655           root    7u  IPv6 0x4ec86f4f746ca4f5      0t0    UDP *:514

这是我的 logstash 配置的内容：

input { 
    syslog {
    } 
}

filter {
    json {
        source => "message"
    }
}

filter {
    if ["program"] == "myprogram" {
        date {
            match => [ "timestamp_rcvd", "UNIX_MS" ]
        }
        date {
            match => [ "timestamp_rcvd", "UNIX_MS" ]
            target => "timestamp_rcvd"
        }
        date {
            match => [ "timestamp", "UNIX_MS" ]
            target => "timestamp"
        }
    }
}

filter {
    mutate {
        remove_field => [ "facility", "message", "@version", "host", "priority", "severity", "facility_label", "severity_label" ]
    }
}

output { 
stdout { }
elasticsearch { embedded => true }
}

我在我的 Mac Pro 上做这一切。在谷歌上搜索类似的问题让我找到https://logstash.jira.com/browse/LOGSTASH-840

【问题讨论】：

标签： macos udp syslog logstash

【解决方案1】：

关闭系统日志

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.syslogd.plist

然后运行 logstash 工作。希望它可以帮助其他有类似问题的人。

【讨论】：