просмотр системных журналов на кибане с помощью logstash - PullRequest
Новая
       4

просмотр системных журналов на кибане с помощью logstash

0 голосов
/ 25 июня 2018

Я выполнил действия, показанные на видео .Я пытаюсь запустить приведенный ниже файл logstash3.conf: 

  input{
   file{
       path=>"/var/log/syslog"
       start_position=>"beginning"
       sincedb_path => "/dev/null"  
  }
 }
output{
   elasticsearch{
   hosts=>["elasticsearch:9200"]
   index=>"pop"
   }
   stdout{} 
}

Я дал следующую команду для запуска файла logstash3.conf 

docker run -h logstash3 --name logstash3 --link elasticsearch:elasticsearch  --rm -v "$PWD":/config-dir logstash -f /config-dir/logstash3.conf

Я получаю следующую ошибку (после которойон ничего не выводит на экран): 

Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
10:00:19.082 [main] INFO  logstash.modules.scaffold - Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
10:00:19.091 [main] INFO  logstash.modules.scaffold - Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"}
10:00:19.163 [main] INFO  logstash.setting.writabledirectory - Creating directory {:setting=>"path.queue", :path=>"/var/lib/logstash/queue"}
10:00:19.164 [main] INFO  logstash.setting.writabledirectory - Creating directory {:setting=>"path.dead_letter_queue", :path=>"/var/lib/logstash/dead_letter_queue"}
10:00:19.275 [LogStash::Runner] INFO  logstash.agent - No persistent UUID file found. Generating new UUID {:uuid=>"81be107c-ad55-4efb-b7a9-873179a33b06", :path=>"/var/lib/logstash/uuid"}
10:00:20.737 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://elasticsearch:9200/]}}
10:00:20.738 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Running health check to see if an Elasticsearch connection is working {:healthcheck_url=>http://elasticsearch:9200/, :path=>"/"}
10:00:20.969 [[main]-pipeline-manager] WARN  logstash.outputs.elasticsearch - Restored connection to ES instance {:url=>"http://elasticsearch:9200/"}
10:00:21.342 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Using mapping template from {:path=>nil}
10:00:21.345 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - Attempting to install template {:manage_template=>{"template"=>"logstash-*", "version"=>50001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"_default_"=>{"_all"=>{"enabled"=>true, "norms"=>false}, "dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date", "include_in_all"=>false}, "@version"=>{"type"=>"keyword", "include_in_all"=>false}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}}
10:00:21.364 [[main]-pipeline-manager] INFO  logstash.outputs.elasticsearch - New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//elasticsearch:9200"]}
10:00:21.377 [[main]-pipeline-manager] INFO  logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>125}
10:00:21.962 [[main]-pipeline-manager] INFO  logstash.pipeline - Pipeline main started
10:00:22.129 [Api Webserver] INFO  logstash.agent - Successfully started Logstash API endpoint {:port=>9600}

Пожалуйста, дайте мне знать, как я могу исправить ошибку?

...