ELK-logstash.conf总是错的

Question

我想将Filebeat与logstash一起使用。但是logstash.conf是错误的。

logstash.conf：

'''

input {
beats {
port => "5044"
}
}
output {
elasticsearch {
hosts => [ "localhost:9200" ]
}
}

'''

它回应了这一点：

无法执行操作 {：action=>LogStash：:P ipelineAction：：Create/pipeline_id：main， ：exception=>"LogStash：：ConfigurationError"， ：message=>"第 3 行第 1 列(字节 76)的预期 #、输入、过滤器、输出之一，在 "， ：backtrace=>["/opt/logstash/logstash/logstash-core/lib/logstash/compiler.rb：42：incompile_imperative'", "/opt/logstash/logstash-core/lib/logstash/compiler.rb:50:in

compile_graph'"， "/opt/logstash/logstash/logstash-core/lib/logstash/compiler.rb：12：inblock in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'"， "/opt/logstash/logstash/logstash-core/lib/logstash/compiler.rb：11：incompile_sources'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:51:ininitialize'"， "/opt/logstash/logstash-core/lib/logstash/pipeline.rb：171：ininitialize'", "/opt/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:inexecute'"， "/opt/logstash/logstash/logstash-core/lib/logstash/agent.rb：335：inblock in converge_state'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:141:inwith_pipelines'"， "/opt/logstash/logstash-core/lib/logstash/agent.rb：332：inblock in converge_state'", "org/jruby/RubyArray.java:1734:ineach'"， "/opt/logstash/logstash/logstash-core/lib/logstash/agent.rb：319：in converge_state_and_update中的converge_state'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:166:in块"， "/opt/logstash/logstash-core/lib/logstash/agent.rb：141：inwith_pipelines'", "/opt/logstash/logstash-core/lib/logstash/agent.rb:164:inconverge_state_and_update'"， "/opt/logstash/logstash-core/lib/logstash/agent.rb：90：inexecute'", "/opt/logstash/logstash-core/lib/logstash/runner.rb:343:inblock in execute'"， "/opt/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/task.rb：24：in 'block in initialize'"]}

Answer 1

beats 插件是错误的。端口应为数字。

https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html

此外，您没有过滤器插件，也许这也是必要的：

input {
beats {
port => 5044
}
}
filter{}
output {
elasticsearch {
hosts => [ "localhost:9200" ]
}
}