Logstash 'Cannot load an invalid configuration'

Question

我正在尝试为以下输入配置 logstash - nginx 访问、nginx 错误和遵循自定义模式的日志，下面是 logstash.conf

input {
  beats {
    port => 5044

codec => multiline {
      # Grok pattern names are valid! :)
      pattern => "^%{TIMESTAMP_ISO8601} "
      negate => true
      what => previous
    }
    }
}

filter {

if [type] == "nginx-access" {
        grok {
        match => [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"]
        overwrite => [ "message" ]
        }

        mutate {
                convert => ["response", "integer"]
                convert => ["bytes", "integer"]
                convert => ["responsetime", "float"]
        }

        geoip {
                source => "clientip"
                target => "geoip"
                add_tag => [ "nginx-geoip" ]
        }

        date {
                match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ]
                remove_field => [ "timestamp" ]
        }

        useragent { 
                source => "agent"
        }

}  else if [type] == "nginx-error" { 
        grok {
        match => [ "message" , "(?<timestamp>%{YEAR}[./-]%{MONTHNUM}[./-]%{MONTHDAY}[- ]%{TIME}) \[%{LOGLEVEL:severity}\] %{POSINT:pid}#%{NUMBER}: %{GREEDYDATA:errormessage}(?:, client: (?<client>%{IP}|%{HOSTNAME}))(?:, server: %{IPORHOST:server})(?:, request: %{QS:request})?(?:, upstream: \"%{URI:upstream}\")?(?:, host: %{QS:host})?(?:, referrer: \"%{URI:referrer}\")"] 
        overwrite => [ "message" ]
        }

geoip {
                source => "client"
                target => "geoip"
                add_tag => [ "nginx-geoip" ]
        }

        date {
                match => [ "timestamp" , "YYYY/MM/dd HH:mm:ss" ]
                remove_field => [ "timestamp" ]
        }

} else {

  mutate {
    gsub => ["message", "\n", " "]
  }
  grok {
    match => [ "message", "%{TIMESTAMP_ISO8601:timestamp} \[%{NOTSPACE:uid}\] \[%{NOTSPACE:thread}\] %{LOGLEVEL:loglevel} %{DATA:class}\-%{GREEDYDATA:message}" ]
    overwrite => [ "message" ]
  }
  date {
    match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss" ]
    target => "@timestamp"
  }
  if "_grokparsefailure" in [tags] {
            drop { }
  }
}
}

output {

stdout { codec => rubydebug }
if [type] == "nginx-access" {
  elasticsearch { hosts => localhost }
  index => "nginx-access-%{+YYYY.MM.dd}"
} else if [type] == "nginx-error" {
  elasticsearch { hosts => localhost }
  index => "nginx-error-%{+YYYY.MM.dd}"
} else {
  elasticsearch { hosts => localhost }
}

}

但是在运行上，我得到以下错误

ERROR logstash.agent - Cannot load an invalid configuration {:reason=>"Expected one of #, { 
at line 84, column 9 (byte 1883) after output {\n \nstdout { codec => rubydebug }\nif [type] == 
\"nginx-access\" {\n elasticsearch { hosts => localhost }\n index "}

我不确定错误是什么。有人可以帮我解决吗？

我也尝试了运行 hexdump & 似乎没有乱码

Answer 1

我想你忘记了“”来放置本地主机

 elasticsearch { 
    hosts => ["localhost"]
    index => "%{tempIndex}-%{+xxxx.ww}"
    document_type => "%{[@metadata][type]}"
 }

Answer 2

正确答案是 'index' 在 elasticsearch 块中，如下所示

output {

stdout { codec => rubydebug }
if [type] == "nginx-access" {
  elasticsearch { hosts => localhost 
    index => "nginx-access-%{+YYYY.MM.dd}"
  }
} else if [type] == "nginx-error" {
  elasticsearch { 
      hosts => localhost 
      index => "nginx-error-%{+YYYY.MM.dd}"
  }

} else {
  elasticsearch { 
      hosts => localhost 
  }
}
}

Logstash 'Cannot load an invalid configuration'

Logstash 'Cannot load an invalid configuration'

nginx

logstash

logstash-grok

elastic-stack