Logstash不创建索引

Question

我已经安装了logstash 1.5.0和elasticsearch 1.5.1。Kibana通过nginx启动并运行logstash接口。

然而，logstash似乎没有创建一个弹性搜索索引。

这是当我尝试从elasticsearch卷曲索引时得到的结果:

[root@aoadbld00032lb ~]# curl -s http://127.0.0.1:9200/_status?pretty=true
{
  "_shards" : {
    "total" : 0,
    "successful" : 0,
    "failed" : 0
  },
  "indices" : { }
}

这是我在logstash日志中看到的:

{:timestamp=>"2015-05-17T16:45:08.435000-0400", :message=>"Using version 0.1.x     input plugin 'tcp'. This plugin isn't well supporte
d by the community and likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:08.449000-0400", :message=>"Using version 0.1.x     codec plugin 'line'. This plugin isn't well support
ed by the community and likely has no maintainer.", :level=>:info}
    {:timestamp=>"2015-05-17T16:45:08.458000-0400", :message=>"Using version     0.1.x input plugin 'udp'. This plugin isn't well supported by the community and     likely has no maintainer.", :level=>:info}
    {:timestamp=>"2015-05-17T16:45:08.462000-0400", :message=>"Using version         0.1.x codec plugin 'plain'. This plugin isn't well supported by the community and     likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:08.474000-0400", :message=>"Using version 0.1.x filter plugin 'grok'. This plugin isn't well supported by the community and likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:08.482000-0400", :message=>"Using version 0.1.x     filter plugin 'syslog_pri'. This plugin isn't well supported by the community and     likely has no maintainer.", :level=>:info}
    {:timestamp=>"2015-05-17T16:45:08.500000-0400", :message=>"Using version 0.1.    x filter plugin 'date'. This plugin isn't well supported by the community and likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:08.510000-0400", :message=>"Using version 0.1.x     filter plugin 'mutate'. This plugin isn't well supported by the community and     likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:08.808000-0400", :message=>"Using version 0.1.x     output plugin 'elasticsearch'. This plugin isn't well supported by the community     and likely has no maintainer.", :level=>:info}
{:timestamp=>"2015-05-17T16:45:09.781000-0400", :message=>"Starting tcp input     listener", :address=>"0.0.0.0:5000", :level=>:info}
{:timestamp=>"2015-05-17T16:45:09.807000-0400", :message=>"Starting UDP     listener", :address=>"0.0.0.0:5000", :level=>:info}

我认为粗体的输出可能很重要!

这是我的logstash.conf文件:

[root@aoadbld00032lb ~]# cat /etc/logstash/logstash.conf
input {
  tcp {
    port => 5000
    type => syslog
  }
  udp {
    port => 5000
    type => syslog
  }
}
filter {
  if [type] == "syslog" {
    grok {
          match => { "message" => "%{SYSLOG5424PRI}%{NONNEGINT:syslog5424_ver} +(?:%{TIMESTAMP_ISO8601:syslog5424_ts}|-) +(?:%{HOSTNAME:syslog5424_host}|-) +(?:%{NOTSPACE:syslog5424_app}|-) +(?:%{NOTSPACE:syslog5424_proc}|-) +(?:%{WORD:syslog5424_msgid}|-) +(?:%{SYSLOG5424SD:syslog5424_sd}|-|) +%{GREEDYDATA:syslog5424_msg}" }
    }
    syslog_pri { }
    date {
  match => [ "syslog_timestamp", "MMM  d HH:mm:ss", "MMM dd HH:mm:ss" ]
    }
    if !("_grokparsefailure" in [tags]) {
      mutate {
        replace => [ "@source_host", "%{syslog_hostname}" ]
        replace => [ "@message", "%{syslog_message}" ]
      }
    }
    mutate {
      remove_field => [ "syslog_hostname", "syslog_message", "syslog_timestamp" ]
    }
  }
}
output {
  elasticsearch {
    host => "127.0.0.1"
    embedded => false
    cluster => "optl_elasticsearch"
 }
    }

我可以得到一些建议，如何得到这个logstash设置索引在弹性搜索?

Answer 1

在我按照本教程设置ELK之后，它为我创建了它的索引，可能会对你有所帮助。请查看带有生成器的配置文件。

http://operational.io/elk-stack-for-network-operations-reloaded/