tcp 插件发生意外错误

Question

我做了一个简单的logstash配置：

tcp.conf

input {
  tcp {
    port => 22
    type => syslog
  }  
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => [ "received_at", "%{@timestamp}" ]
      add_field => [ "received_from", "%{host}" ]
    }
    syslog_pri { }
    date {
      match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
  }
}

output {
  stdout { codec => rubydebug }
}

运行配置：

bin/logstash -f tcp.conf

正在执行此命令：

telnet localhost 22

我收到这个错误：

Using milestone 2 input plugin 'tcp'. This plugin should be stable, but if you see strange behavior, please let us know! For more information on plugin milestones, see http://logstash.net/docs/1.4.2/plugin-milestones {:level=>:warn}
Using milestone 1 filter plugin 'syslog_pri'. This plugin should work, but would benefit from use by folks like you. Please let us know if you find bugs or have suggestions on how to improve this plugin.  For more information on plugin milestones, see http://logstash.net/docs/1.4.2/plugin-milestones {:level=>:warn}

+---------------------------------------------------------+
| An unexpected error occurred. This is probably a bug.   |
| You can find help with this problem in a few places:    |
|                                                         |
| * chat: #logstash IRC channel on freenode irc.          |
|     IRC via the web: http://goo.gl/TI4Ro                |
| * email: logstash-users@googlegroups.com                |
| * bug system: https://logstash.jira.com/                |
|                                                         |
+---------------------------------------------------------+
The error reported is: 
  Permission denied - bind(2)

我正在做这个配置 Syslog example

Answer 1

"Permission denied - bind" 表示 logstash 无法将自身附加到列出的端口。

通常，这是因为您运行 logstash 作为非特权用户无法访问编号低于 1024 的端口。

在你的例子中，你正在尝试连接到端口 22。作为 ssh/scp/sftp 端口，这似乎是一个寻找日志文件的奇怪地方。

tcp 插件发生意外错误

An unexpected error occurred with tcp plugin

monitoring

tcp

syslog

logstash

tcp.conf

运行配置：

正在执行此命令：

我收到这个错误：