ELK-logstash.conf总是错的

Question

我想将 Filebeat 与 logstash.But 一起使用，但 logstash.conf 是错误的。

logstash.conf:

```

input {
    beats {
        port => "5044"
    }
}

output {
    elasticsearch {
        hosts => [ "localhost:9200" ]
    }
}

```

它回应了这个：

无法执行操作 {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 3, column 1 (byte 76) after ", :backtrace =>[[/opt/logstash/logstash-core/lib/logstash/compiler.rb:42:in compile_imperative'", "/opt/logstash/logstash-core/lib/logstash/compiler.rb:50:incompile_graph'", "/opt/logstash/logstash-core/lib/logstash/compiler.rb:12:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap", " /opt/logstash/logstash-core/lib/logstash/compiler.rb:11:in compile_sources'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:51:ininitialize'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:171:in initialize'", "/opt/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:inexecute'", "/opt/logstash/logstash-core/lib/logstash/agent.rb: 335:in block in converge_state'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:141:inwith_pipelines'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:332:in block in converge_state'", "org/jruby/RubyArray.java:1734:ineach", "/opt/logstash/logstash-core/lib/logstash/agent.rb:319:in converge_state'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:166:in在 converge_state_and_update'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:141:in with_pipelines'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:164:inconverge_state_and_update", "/opt/logstash/logstash-core/lib/logstash/agent.rb:90:在 execute'", "/opt/logstash/logstash-core/lib/logstash/runner.rb:343:inblock in execute'", "/opt/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb:24:in `block in initialize'"]}

Answer 1

beats插件错误。端口应该是一个数字。

https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html

而且你没有过滤器插件，也许这也是必要的:

input {
    beats {
        port => 5044
    }
}
filter{}
output {
    elasticsearch {
        hosts => [ "localhost:9200" ]
    }
}

ELK-logstash.conf总是错的

ELK-logstash.conf is always wrong

logstash

logstash-configuration

filebeat