Я пытаюсь отправить журнал 4net log в logsta sh, чтобы его проанализировали, а затем попал вasticsearch. Я добавил порт в настройку безопасности брандмауэра windows и разрешил все подключения как к 5044, так и к 9600.
В журнале ударов файла я получаю эту ошибку
pipeline/output.go:100 Failed to connect to backoff(async(tcp://[http://hostname:5044]:5044)): lookup http://hostname:5044: no such host
Filebeat.yml (раздел Logsta sh)
#----------------------------- Logstash output --------------------------------
output.logstash:
# The Logstash hosts
hosts: ["http://hostname:5044"]
# Optional SSL. By default is off.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"
# Client Certificate Key
#ssl.key: "/etc/pki/client/cert.key"
#================================ Processors =====================================
Logsta sh .yml
Я установил http.host на 0.0 .0.0
# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#
http.host: "0.0.0.0"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
# http.port: 9600-9700
Logsta sh Конфигурация фильтра
input {
beats {
port => "5044"
}
}
filter {
if [type] == "log4net" {
grok {
match => [ "message", "%{TIMESTAMP_ISO8601:timestamp} \[%{NUMBER:threadid}\] %{WORD:level}\s*%{DATA:class} \[%{DATA:NDC}\]\s+-\s+%{GREEDYDATA:message}" ]
}
date {
match => ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
remove_field => ["timestamp"]
}
mutate {
update => {
"type" => "log4net-logs"
}
}
}
}
output {
elasticsearch {
hosts => ["http://hostname:9200"]
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
#user => "elastic"
#password => "changeme"
}
}