Logstash 中的“预期的#, =>”是什么意思？

Question

我们为我们称为 kubernetes-internal 的 Logstash 7.6.2 管道编写了一个配置文件。

我们检查了bin/logstash --config.test_and_exit -f ../kubernetes-internal/02-filter.conf 的语法，似乎我们在语法中遗漏了一些东西：

[FATAL] 2020-04-29 10:41:42.006 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of #, => at line 152, column 8 (byte 5565) after filter {

查看那部分代码，我们有：

...
  else {
    if [kubernetes][labels][version] != "v2" {
      date {
        match => [ "syslog_timestamp", "ISO8601" ]
        remove_field => [ "syslog_timestamp" ]
           }
                                             }
    prune {
      whitelist_names => ["^message_csv$","^host$","^beat","^source$","^type$","^offset$","@timestamp","kubernetes"]
          }
    mutate {
      add_tag => [ "haproxy-logs" ]
      remove_tag => [ "_csvparsefailure" ]
           }
       }
  else {
    if "ambassador" in [kubernetes][labels][service] { #Line152
      grok {
        match => { "message" => '^%{TIMESTAMP_ISO8601:time} %{IP:clientip}:%{NUMBER:port} %{WORD:verb} %{NOTSPACE:request} HTTP/%{NUMBER:httpversion} %{NUMBER:http_status} %{NOTSPACE:response_flag} %{NUMBER:bytes_received} %{NUMBER:bytes_sent} %{NUMBER:request_time} \'%{NOTSPACE:X-Forwarded-for}\' \'%{NOTSPACE:X-OURDOMAIN-Api}\' \'%{DATA:agent}\' \'%{NOTSPACE:UUID}\' \'%{NOTSPACE:X-Forwarded-Client-Cert}\' \'%{NOTSPACE:authority}\' \'%{NOTSPACE:upstream_host}\'$' }
           }
      mutate {
      convert => {
        "http_status"    => "integer"
        "bytes_sent"     => "integer"
        "bytes_received" => "integer"
        "request_time"   => "integer"
                 }
...

到目前为止，我们缺少什么？

Answer 1

很难说，因为括号太乱而且被截断了。

我的意思是，它清楚地显示为after filter { ...但没有filter {。

曾经尝试过翻转条件吗？或者尝试像in 操作员所期望的那样添加括号？

if [kubernetes][labels][service] == "ambassador" {

if [kubernetes][labels][service] in ("ambassador") {

这个条件甚至可能完全错误，因为这可能是component 标签；例如。 app.kubernetes.io/component: ambassador-service。但在不知道标签是如何定义的情况下，只能假设。

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

尝试直接查询它们，以便找到条件：

kubectl get pods -l 'service in (ambassador)'