我正在尝试使用 json 文件在 elasticsearch 云上创建索引。我已经创建了如下所示的配置：
input {
file {
path => ["/root/leads.json"]
start_position => "beginning"
ignore_older => 0
}
}
output {
elasticsearch {
hosts => ["https://ac9xxxxxxxxxxxxxb.us-east-1.aws.found.io:9243"]
user => "elastic"
password => "xxxxxxxxxxxxxx"
}
}
我可以使用以下命令运行logstash：
sudo bin/logstash -f /etc/logstash/conf.d/logstash.conf
Logstash 启动管道，但我没有看到在 elasticsearch 中创建任何索引：
[INFO ] 2018-11-14 09:16:01.821 [[main]>worker1] file - No sincedb_path set, generating one based on the "path" setting {:sincedb_path=>"/usr/share/logstash/data/plugins/inputs/file/.sincedb_43b5fa3acfcfc04b3df80a7c15c8d991", :path=>["/root/leads.json"]}
[INFO ] 2018-11-14 09:16:01.852 [Converge PipelineAction::Create<main>] pipeline - Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x2fda8150 run>"}
[INFO ] 2018-11-14 09:16:01.944 [Ruby-0-Thread-1: /usr/share/logstash/lib/bootstrap/environment.rb:6] agent - Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[INFO ] 2018-11-14 09:16:01.996 [[main]<file] observingtail - START, creating Discoverer, Watch with file and sincedb collections
[INFO ] 2018-11-14 09:16:02.522 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
您应该像这样更改您的配置：
input {
file {
path => ["/root/leads.json"]
start_position => "beginning"
sincedb_path => "/dev/null"
}
}
Remove ignore_older => 0因为这将有效地忽略早于 0 秒的文件:-)
添加sincedb_path确保您可以从文件开头多次运行管道。
本文内容由网友自发贡献，版权归原作者所有，本站不承担相应法律责任。如您发现有涉嫌抄袭侵权的内容，请联系:hwhale#tublm.com(使用前将#替换为@)
