Logstash 不从配置的输入文件中读取

Question

我正在尝试将我的 Logstash 配置为从指定的日志文件中读取。当我将其配置为从 stdin 读取时，它按预期工作，我的输入导致来自 Logstash 的消息并显示在我的 Kibana UI.

$ cat /tmp/logstash-stdin.conf 
input {
  stdin {}
}
output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }

}

$./logstash -f /tmp/logstash-stdin.conf
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path //usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
The stdin plugin is now waiting for input:
hellloooo
{
      "@version" => "1",
          "host" => "myhost.com",
    "@timestamp" => 2017-11-17T16:05:41.595Z,
       "message" => "hellloooo"
}

但是，当我运行 Logstash 使用文件输入时，我没有看到文件已加载到 Logstash 中的指示，并且它也没有显示在 Kibana 中。

$ cat /tmp/logstash-simple.conf 
input {
  file {
    path => "/tmp/test_log.txt"
    type => "syslog"
  }
}
output {
  elasticsearch { hosts => ["localhost:9200"] }
  stdout { codec => rubydebug }
}


$ ./logstash -f /tmp/logstash-simple.conf 
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path //usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console

关于如何解决我的 Logstash 未摄取配置文件的问题的任何建议？

Answer 1

默认情况下，文件输入插件从文件末尾开始读取，因此只会处理在 Logstash 启动后添加的行。要在启动时读取所有现有行，请将选项 "start_position" => "beginning" 添加到配置中，如 explained in documentation.

Logstash 不从配置的输入文件中读取

Logstash doesnt read from configured input file

logstash

elastic-stack