Logstash 中的配置错误

Question

当我运行这个配置文件时：

input {
  file {
    path => "/tmp/linuxServerHealthReport.csv"
    start_position => "beginning"
    sincedb_path => "/home/infra/logstash-7.14.1/snowdb/health_check"
  }
  codec => multiline {
    pattern => "\""
    negate => true
    what => previous
  }
}

filter {
  csv {
    columns => ["Report_timestamp","Hostname","OS_Relese","Server_Uptime","Internet_Status","Current_CPU_Utilization","Current_Memory_Utilization","Current_SWAP_Utilization","FS_Utilization","Inode_Utilization","FS_Read_Only_Mode_Status","Disk_Multipath_Status","Besclient_Status","Antivirus_Status","Cron_Service_Status","Nagios_Status","Nagios_Heartbest_Status","Redhat_Cluster_Status"]
    separator => ","
    skip_header => true
  }
  mutate {
    remove_field => ["path", "host"]
  }
  skip_empty_columns => true
  skip_empty_row => true
}

# quote_char => "'"

output {
  stdout { codec => rubydebug }
}

我收到这个错误：

错误： [2021-09-22T15:57:04,929][错误][logstash.agent] 无法执行操作 {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash ::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", "{" at line 7, column 9 (byte 226) after input {\n file {\n\t\tpath => "/tmp/linuxServerHealthReport.csv"\n start_position => "开始"\n sincedb_path => "/home/imiinfra/logstash-7.14.1/snowdb/health_check"\n } \n\t\tcodec ", :backtrace=>[""/home/imiinfra/logstash-7.14.1/logstash-core/lib/logstash/compiler.rb:32:in compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:187:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in initialize'", "/home/imiinfra/logstash-7.14.1/logstash-core/lib/logstash/java_pipeline.rb:47:in initialize'", "/home/imiinfra/logstash-7.14.1/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute'", "/home/imiinfra/logstash-7.14.1/logstash-core/lib/logstash/agent.rb:391:in block in converge_state'" ]}

Answer 1

你必须处理你的格式，但这是我从问题中重建的。主要问题似乎是 file 的参数，您出于某种原因将 codec 放在 file 之外。另一个问题是 csv 参数 skip_empty_columns 和 skip_empty_row 也在 csv.

之外

所以我做了一些格式化并修复了这些问题，现在应该可以使用了。

input {
  file {
    path => "/tmp/linuxServerHealthReport.csv"
    codec => multiline {
      pattern => "\""
      negate => true
      what => previous
    }
    start_position => "beginning"
    sincedb_path => "/home/infra/logstash-7.14.1/snowdb/health_check"
  }
}

filter {
  csv {
    columns => ["Report_timestamp","Hostname","OS_Relese","Server_Uptime","Internet_Status","Current_CPU_Utilization","Current_Memory_Utilization","Current_SWAP_Utilization","FS_Utilization","Inode_Utilization","FS_Read_Only_Mode_Status","Disk_Multipath_Status","Besclient_Status","Antivirus_Status","Cron_Service_Status","Nagios_Status","Nagios_Heartbest_Status","Redhat_Cluster_Status"]
    separator => ","
    skip_header => true
    skip_empty_columns => true
    skip_empty_row => true
  }
  mutate {
    remove_field => ["path", "host"]
  }
}

output {
  stdout { codec => rubydebug }
}

Logstash 中的配置错误

ConfigurationError in Logstash

logstash

logstash-grok