logstash-8.9.0-windows-x86_64
logstash.conf
input {
tcp {
mode => "server"
host => "0.0.0.0"
port => 4560
codec => json_lines
type => "debug"
}
tcp {
mode => "server"
host => "0.0.0.0"
port => 4561
codec => json_lines
type => "error"
}
tcp {
mode => "server"
host => "0.0.0.0"
port => 4562
codec => json_lines
type => "business"
}
tcp {
mode => "server"
host => "0.0.0.0"
port => 4563
codec => json_lines
type => "record"
}
}
filter{
if [type] == "record" {
mutate {
remove_field => "port"
remove_field => "host"
remove_field => "@version"
}
json {
source => "message"
remove_field => ["message"]
}
}
}
output {
elasticsearch {
hosts => "localhost:9200"
index => "mall-%{type}-%{+YYYY.MM.dd}"
}
}
就是这里错了，识别不到配置文件
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0in>logstash -f logstash.conf
Microsoft Windows [版本 6.1.7601]
版权所有 (c) 2009 Microsoft Corporation。保留所有权利。
C:UsersAdministrator>F:
F:>
F:>
F:>cd F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0in
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0in>
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0in>
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0in>
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0in>logstash -f logstash.conf
"Using bundled JDK: F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0jdkinjava.exe"
Sending Logstash logs to F:/Document_Elastic/logstash-8.9.0-windows-x86_64/logstash-8.9.0/logs which is now configured via log4j2.properties
[2023-08-05T00:13:14,106][INFO ][logstash.runner ] Log4j configuration path used is: F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0configlog4j2.properties
[2023-08-05T00:13:14,112][WARN ][logstash.runner ] The use of JAVA_HOME has been deprecated. Logstash 8.0 and later ignores JAVA_HOME and uses the bundled JDK. Running Logstash with the bundled JDK i
s recommended. The bundled JDK has been verified to work with each specific version of Logstash, and generally provides best performance and reliability. If you have compelling reasons for using your own JDK
(organizational-specific compliance requirements, for example), you can configure LS_JAVA_HOME to use that version instead.
[2023-08-05T00:13:14,114][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"8.9.0", "jruby.version"=>"jruby 9.3.10.0 (2.6.8) 2023-02-01 107b2e6697 OpenJDK 64-Bit Server VM 17.0.7+7 on
17.0.7+7 +indy +jit [x86_64-mswin32]"}
[2023-08-05T00:13:14,118][INFO ][logstash.runner ] JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -XX:+HeapDumpOnOutOfMemor
yError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=
ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAM
ED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED]
[2023-08-05T00:13:14,131][INFO ][logstash.settings ] Creating directory {:setting=>"path.queue", :path=>"F:/Document_Elastic/logstash-8.9.0-windows-x86_64/logstash-8.9.0/data/queue"}
[2023-08-05T00:13:14,135][INFO ][logstash.settings ] Creating directory {:setting=>"path.dead_letter_queue", :path=>"F:/Document_Elastic/logstash-8.9.0-windows-x86_64/logstash-8.9.0/data/dead_letter_qu
eue"}
[2023-08-05T00:13:14,201][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2023-08-05T00:13:14,218][INFO ][logstash.agent ] No persistent UUID file found. Generating new UUID {:uuid=>"b8c7a272-8bef-4c98-9ea8-36acd6a5af57", :path=>"F:/Document_Elastic/logstash-8.9.0-window
s-x86_64/logstash-8.9.0/data/uuid"}
F:/Document_Elastic/logstash-8.9.0-windows-x86_64/logstash-8.9.0/vendor/bundle/jruby/2.6.0/gems/sinatra-2.2.4/lib/sinatra/base.rb:938: warning: constant Tilt::Cache is deprecated
[2023-08-05T00:13:16,771][INFO ][logstash.config.source.local.configpathloader] No config files found in path {:path=>"F:/Document_Elastic/logstash-8.9.0-windows-x86_64/logstash-8.9.0/logstash.conf"}
[2023-08-05T00:13:16,772][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
[2023-08-05T00:13:16,929][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[2023-08-05T00:13:16,938][INFO ][logstash.runner ] Logstash shut down.
[2023-08-05T00:13:16,944][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:790) ~[jruby.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:753) ~[jruby.jar:?]
at F_3a_.Document_Elastic.logstash_minus_8_dot_9_dot_0_minus_windows_minus_x86_64.logstash_minus_8_dot_9_dot_0.lib.bootstrap.environment.<main>(F:Document_Elasticlogstash-8.9.0-windows-x86_64logsta
sh-8.9.0libootstrapenvironment.rb:91) ~[?:?]
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0>.inlogstash.bat -f .configlogstash.conf
Microsoft Windows [版本 6.1.7601]
版权所有 (c) 2009 Microsoft Corporation。保留所有权利。
C:UsersAdministrator>F:
F:>
F:>
F:>cd F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0in
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0in>
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0in>
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0in>
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0in>cd ..
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0>
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0>
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0>
F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0>.inlogstash.bat -f .configlogstash.conf
"Using bundled JDK: F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0jdkinjava.exe"
Sending Logstash logs to F:/Document_Elastic/logstash-8.9.0-windows-x86_64/logstash-8.9.0/logs which is now configured via log4j2.properties
[2023-08-05T00:22:28,251][INFO ][logstash.runner ] Log4j configuration path used is: F:Document_Elasticlogstash-8.9.0-windows-x86_64logstash-8.9.0configlog4j2.properties
[2023-08-05T00:22:28,256][WARN ][logstash.runner ] The use of JAVA_HOME has been deprecated. Logstash 8.0 and later ignores JAVA_HOME and uses the bundled JDK. Running Logstash with the bundled JDK i
s recommended. The bundled JDK has been verified to work with each specific version of Logstash, and generally provides best performance and reliability. If you have compelling reasons for using your own JDK
(organizational-specific compliance requirements, for example), you can configure LS_JAVA_HOME to use that version instead.
[2023-08-05T00:22:28,260][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"8.9.0", "jruby.version"=>"jruby 9.3.10.0 (2.6.8) 2023-02-01 107b2e6697 OpenJDK 64-Bit Server VM 17.0.7+7 on
17.0.7+7 +indy +jit [x86_64-mswin32]"}
[2023-08-05T00:22:28,268][INFO ][logstash.runner ] JVM bootstrap flags: [-Xms1g, -Xmx1g, -Djava.awt.headless=true, -Dfile.encoding=UTF-8, -Djruby.compile.invokedynamic=true, -XX:+HeapDumpOnOutOfMemor
yError, -Djava.security.egd=file:/dev/urandom, -Dlog4j2.isThreadContextMapInheritable=true, -Djruby.regexp.interruptible=true, -Djdk.io.File.enableADS=true, --add-exports=jdk.compiler/com.sun.tools.javac.api=
ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.parser=ALL-UNNAMED, --add-exports=jdk.compiler/com.sun.tools.javac.tree=ALL-UNNAMED
, --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED, --add-opens=java.base/java.security=ALL-UNNAMED, --add-opens=java.base/java.io=ALL-UNNAMED, --add-opens=java.base/java.nio.channels=ALL-UNNAM
ED, --add-opens=java.base/sun.nio.ch=ALL-UNNAMED, --add-opens=java.management/sun.management=ALL-UNNAMED]
[2023-08-05T00:22:28,335][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
F:/Document_Elastic/logstash-8.9.0-windows-x86_64/logstash-8.9.0/vendor/bundle/jruby/2.6.0/gems/sinatra-2.2.4/lib/sinatra/base.rb:938: warning: constant Tilt::Cache is deprecated
[2023-08-05T00:22:30,216][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>false}
[2023-08-05T00:22:30,685][INFO ][org.reflections.Reflections] Reflections took 138 ms to scan 1 urls, producing 132 keys and 464 values
[2023-08-05T00:22:31,018][INFO ][logstash.codecs.jsonlines] ECS compatibility is enabled but `target` option was not specified. This may cause fields to be set at the top-level of the event where they are lik
ely to clash with the Elastic Common Schema. It is recommended to set the `target` option to avoid potential schema conflicts (if your data is ECS compliant or non-conflicting, feel free to ignore this messag
e)
[2023-08-05T00:22:31,069][INFO ][logstash.codecs.jsonlines] ECS compatibility is enabled but `target` option was not specified. This may cause fields to be set at the top-level of the event where they are lik
ely to clash with the Elastic Common Schema. It is recommended to set the `target` option to avoid potential schema conflicts (if your data is ECS compliant or non-conflicting, feel free to ignore this messag
e)
[2023-08-05T00:22:31,114][INFO ][logstash.codecs.jsonlines] ECS compatibility is enabled but `target` option was not specified. This may cause fields to be set at the top-level of the event where they are lik
ely to clash with the Elastic Common Schema. It is recommended to set the `target` option to avoid potential schema conflicts (if your data is ECS compliant or non-conflicting, feel free to ignore this messag
e)
[2023-08-05T00:22:31,159][INFO ][logstash.codecs.jsonlines] ECS compatibility is enabled but `target` option was not specified. This may cause fields to be set at the top-level of the event where they are lik
ely to clash with the Elastic Common Schema. It is recommended to set the `target` option to avoid potential schema conflicts (if your data is ECS compliant or non-conflicting, feel free to ignore this messag
e)
[2023-08-05T00:22:31,326][INFO ][logstash.javapipeline ] Pipeline `main` is configured with `pipeline.ecs_compatibility: v8` setting. All plugins in this pipeline will default to `ecs_compatibility => v8`
unless explicitly configured otherwise.
[2023-08-05T00:22:31,347][INFO ][logstash.outputs.elasticsearch][main] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//127.0.0.1:9200"]}
[2023-08-05T00:22:31,454][INFO ][logstash.outputs.elasticsearch][main] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://127.0.0.1:9200/]}}
[2023-08-05T00:22:32,502][INFO ][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information", :except
ion=>Manticore::SocketException, :cause=>#<Java::OrgApacheHttpConn::HttpHostConnectException: Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information>}
[2023-08-05T00:22:32,506][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://127.0.0.1:9200/", :exception=>LogStash::Outputs::E
lasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://127.0.0.1:9200/][Manticore::SocketException] Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refus
ed: no further information"}
[2023-08-05T00:22:32,519][INFO ][logstash.outputs.elasticsearch][main] Not eligible for data streams because config contains one or more settings that are not compatible with data streams: {"index"=>"mall-%{t
ype}-%{+YYYY.MM.dd}"}
[2023-08-05T00:22:32,522][INFO ][logstash.outputs.elasticsearch][main] Data streams auto configuration (`data_stream => auto` or unset) resolved to `false`
[2023-08-05T00:22:32,527][INFO ][logstash.filters.json ][main] ECS compatibility is enabled but `target` option was not specified. This may cause fields to be set at the top-level of the event where they a
re likely to clash with the Elastic Common Schema. It is recommended to set the `target` option to avoid potential schema conflicts (if your data is ECS compliant or non-conflicting, feel free to ignore this
message)
[2023-08-05T00:22:32,549][INFO ][logstash.javapipeline ][main] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight
"=>1000, "pipeline.sources"=>["F:/Document_Elastic/logstash-8.9.0-windows-x86_64/logstash-8.9.0/config/logstash.conf"], :thread=>"#<Thread:0x5c9f490e@F:/Document_Elastic/logstash-8.9.0-windows-x86_64/logstash
-8.9.0/logstash-core/lib/logstash/java_pipeline.rb:134 run>"}
[2023-08-05T00:22:33,571][INFO ][logstash.javapipeline ][main] Pipeline Java execution initialization time {"seconds"=>1.02}
[2023-08-05T00:22:33,739][INFO ][logstash.javapipeline ][main] Pipeline started {"pipeline.id"=>"main"}
[2023-08-05T00:22:33,742][INFO ][logstash.inputs.tcp ][main][803d567cd3f16665f7432a862e1e98020afd9a295f7d2db89c00cad101eae51d] Starting tcp input listener {:address=>"0.0.0.0:4562", :ssl_enable=>false}
[2023-08-05T00:22:33,744][INFO ][logstash.inputs.tcp ][main][1268f11a7fb6bd4f0b7ff9b09b4b6b0e43318c898a87e95357a67f583f5222dd] Starting tcp input listener {:address=>"0.0.0.0:4563", :ssl_enable=>false}
[2023-08-05T00:22:33,746][INFO ][logstash.inputs.tcp ][main][fc7840d5e5fb7dd6d6e19158bd492ff2ebd3589faf4aaaed2148de9bacc03264] Starting tcp input listener {:address=>"0.0.0.0:4560", :ssl_enable=>false}
[2023-08-05T00:22:33,753][INFO ][logstash.inputs.tcp ][main][54dd0bc6c8620a3cde4f6c2d627b750338a8c8101598a4b97078f63128667802] Starting tcp input listener {:address=>"0.0.0.0:4561", :ssl_enable=>false}
[2023-08-05T00:22:33,759][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2023-08-05T00:22:38,540][INFO ][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information", :except
ion=>Manticore::SocketException, :cause=>#<Java::OrgApacheHttpConn::HttpHostConnectException: Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information>}
[2023-08-05T00:22:38,547][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://127.0.0.1:9200/", :exception=>LogStash::Outputs::E
lasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://127.0.0.1:9200/][Manticore::SocketException] Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refus
ed: no further information"}
[2023-08-05T00:22:43,564][INFO ][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information", :except
ion=>Manticore::SocketException, :cause=>#<Java::OrgApacheHttpConn::HttpHostConnectException: Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information>}
[2023-08-05T00:22:43,567][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://127.0.0.1:9200/", :exception=>LogStash::Outputs::E
lasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://127.0.0.1:9200/][Manticore::SocketException] Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refus
ed: no further information"}
[2023-08-05T00:22:48,582][INFO ][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information", :except
ion=>Manticore::SocketException, :cause=>#<Java::OrgApacheHttpConn::HttpHostConnectException: Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information>}
[2023-08-05T00:22:48,589][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://127.0.0.1:9200/", :exception=>LogStash::Outputs::E
lasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://127.0.0.1:9200/][Manticore::SocketException] Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refus
ed: no further information"}
[2023-08-05T00:22:53,600][INFO ][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information", :except
ion=>Manticore::SocketException, :cause=>#<Java::OrgApacheHttpConn::HttpHostConnectException: Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information>}
[2023-08-05T00:22:53,605][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://127.0.0.1:9200/", :exception=>LogStash::Outputs::E
lasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://127.0.0.1:9200/][Manticore::SocketException] Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refus
ed: no further information"}
[2023-08-05T00:22:58,617][INFO ][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information", :except
ion=>Manticore::SocketException, :cause=>#<Java::OrgApacheHttpConn::HttpHostConnectException: Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information>}
[2023-08-05T00:23:20,998][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://127.0.0.1:9200/", :exception=>LogStash::Outputs::E
lasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://127.0.0.1:9200/][Manticore::SocketException] Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refus
ed: no further information"}
[2023-08-05T00:23:23,002][INFO ][logstash.outputs.elasticsearch][main] Failed to perform request {:message=>"Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information", :except
ion=>Manticore::SocketException, :cause=>#<Java::OrgApacheHttpConn::HttpHostConnectException: Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refused: no further information>}
[2023-08-05T00:23:23,003][WARN ][logstash.outputs.elasticsearch][main] Attempted to resurrect connection to dead ES instance, but got an error {:url=>"http://127.0.0.1:9200/", :exception=>LogStash::Outputs::E
lasticSearch::HttpClient::Pool::HostUnreachableError, :message=>"Elasticsearch Unreachable: [http://127.0.0.1:9200/][Manticore::SocketException] Connect to 127.0.0.1:9200 [/127.0.0.1] failed: Connection refus
ed: no further information"}