Hi. First, thank you for your attention.
Now, I'm trying to give log in my laptop(txt file) to Elasticsearch by logstash.
I have a problem with filters. I checked whether it runs by deleting filter part.
[2019-07-17T18:02:17,470][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, => at line 14, column 16 (byte 187) after filter{\n date{\n match => [ \"timestamp\", \"MMM dd HH:mm:ss\"]\n }\n\noutput{\n elasticsearch", :backtrace=>["/Users/mf839-031/Downloads/logstash-7.2.0/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/Users/mf839-031/Downloads/logstash-7.2.0/logstash-core/lib/logstash/compiler.rb:49:in `compile_graph'", "/Users/mf839-031/Downloads/logstash-7.2.0/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in `map'", "/Users/mf839-031/Downloads/logstash-7.2.0/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/Users/mf839-031/Downloads/logstash-7.2.0/logstash-core/lib/logstash/java_pipeline.rb:24:in `initialize'", "/Users/mf839-031/Downloads/logstash-7.2.0/logstash-core/lib/logstash/pipeline_action/create.rb:36:in `execute'", "/Users/mf839-031/Downloads/logstash-7.2.0/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]}
> input{
> file{
> path => ["/Users/mf839-031/Downloads/logstash-7.2.0/examples.rtf "]
> }
> }
>
> filter{
> date{
> match => [ "timestamp", "MMM dd HH:mm:ss"]
> }
>
> grok{
> match => {" %{USERNAME:user_name} %{USERNAME:process}\[%{NUMBER:code}\]: %{GREEDYDATA:message}"}
> }
>
> }
>
> output{
> elasticsearch{
> hosts => ["localhost:9200"]
> index => "hello"
> }
> }'
and the data look like
ul 17 00:44:57/ MF839-031/ syslogd[39]/: Configuration Notice:
ASL Module "com.apple.install" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
I'm not familiar with coding so it's really hard for me....
If you have a chance, please hlep...
Thanks for reading!!!
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.