Filebeat > Logstash > ElasticSearch - Lumberjack 错误

Question

正在尝试让 Filebeat 与 logstash 一起工作。目前我收到此错误：

2016/11/14 04:54:27.721478 output.go:109: DBG  output worker: publish 2047 events
2016/11/14 04:54:27.756650 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error
2016/11/14 04:54:27.756676 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error
2016/11/14 04:54:28.782729 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error
2016/11/14 04:54:28.782756 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error
2016/11/14 04:54:30.786983 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error
2016/11/14 04:54:30.787017 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error
2016/11/14 04:54:34.808528 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error
2016/11/14 04:54:34.808578 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error

有没有人有解决方案，或者您可以指出正确的方向？

Filebeat v5 和 logstash v5。

在本地执行此操作。

谢谢！

Answer 1

这可能是因为您的 logstash 对您的 filebeat 不可见。请在节拍上启动您的 logstash 作为输入。我已经在端口号 31311 上启动了我的 logstash。

    input {
  beats {
    host => "0.0.0.0"
    port => 31311
  }
}

filebeat.yml 中的配置：ElasticSearch 输出是默认的。请评论它并取消评论 logstash 输出配置。它应该如下所示。

output.logstash:
  # The Logstash hosts
  hosts: ["localhost:31311"]

如果您在这两者之间设置了任何身份验证，请小心。完成此配置后，我能够在 logstash 中看到我的消息，最后在 Kibana 中看到我的消息。希望有用。

Filebeat > Logstash > ElasticSearch - Lumberjack 错误

Filebeat > Logstash > ElasticSearch - Lumberjack Error

elasticsearch

logstash

filebeat