Logstash

Question

我在启动 Logstash 时遇到配置错误。我使用的是 7.5.1 版本。相同的配置文件之前工作。由于旧的 VM 已停用，我不得不在另一个 VM 上设置 ELK stash，我在这里遇到这个错误。

我正在使用 -

实例化 logstash

logstash-7.5.1\bin\logstash -f logstash-config.conf

.

配置文件-

#config file

input{
jdbc{
jdbc_driver_library=>"C:\software\ojdbc7.jar"
jdbc_driver_class=>"Java::oracle.jdbc.driver.OracleDriver"
jdbc_connection_string=>"jdbc:oracle:thin:@<host>:1528:TSTIM"
jdbc_user=>"UName"
jdbc_password=>"PWD"
statement=>"SELECT * from TABLE where run_id > 4500"
}
}

output{
elasticsearch{
hosts=>"http://localhost:9200"
index=>"run_id"
document_type=>"TABLEname"
document_id=>"run_id"
user=>"elastic"
password=>"changeme"
}
stdout{
codec=>rubydebug
}
}

.

错误-

C:\software>logstash-7.5.1\bin\logstash -f logstash-config.conf
Thread.exclusive is deprecated, use Thread::Mutex
Sending Logstash logs to C:/software/logstash-7.5.1/logs which is now configured via log4j2.properties
[2020-01-08T05:04:33,207][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-01-08T05:04:33,426][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.5.1"}
[2020-01-08T05:04:34,869][ERROR][logstash.agent ] Failed to execute action 
{:action=>LogStash::PipelineAction::Create/pipeline_id:main,
:exception=>"LogStash::ConfigurationError",
:message=>"Expected one of [ \t\r\n], "#", "input", "filter", "output" at line 1, column 1 (byte 1)", 
:backtrace=>[
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'",
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/compiler.rb:49:in compile_graph'",
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'",
"org/jruby/RubyArray.java:2584:in map'",
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", 
"org/logstash/execution/AbstractPipelineExt.java:156:in initialize'",
"org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", 
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/java_pipeline.rb:27:in initialize'", 
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", 
"C:/software/logstash-7.5.1/logstash-core/lib/logstash/agent.rb:326:in block in converge_state'"
]}
[2020-01-08T05:04:35,510][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2020-01-08T05:04:40,325][INFO ][logstash.runner ] Logstash shut down.

Answer 1

我的错。配置文件有一些坏字符。我只需要清理一下。将相同的配置内容手动键入另一个文件有效。

Answer 2

我在 Windows 使用 Notepad++ 时遇到了同样的问题。

我的解决方案是将配置保存到 UTF-8 without BOM 和 Unix format (LF)。

Answer 3

我有同样的问题，当 copy/paste 我的配置文件中的某些字符串来自网页时。原因是行首有除“tab”或“whitespace”以外的不可打印字符。如果您 select 在 VS Code 中查看文件的全部内容，您可以看到好行和坏行之间的区别。

我把坏字符换成了空格，问题就解决了。

Logstash | ConfigurationError :message=>Expected one of [ \\t\\r\\n], \"#\", \"input\", \"filter\", \"output\" at line 1, column 1 (byte 1)

Logstash | ConfigurationError :message=>Expected one of [ \\t\\r\\n], \"#\", \"input\", \"filter\", \"output\" at line 1, column 1 (byte 1)

configuration

elastic-stack

elk