Default settings used: Filter workers: 2

(neal) #1

when i start logstash using bin/logtash -f test.config, it shows the message as title
ps. i have removed all .sincedb_* files and the logstash version is 2.0
`input {
file {
path => "/data/tmp/elktest/tollog/pqr/"
start_position => "beginning"
sincedb_path => "/dev/null"

filter {

grok {
match => {
"message" => "%{TIMESTAMP_ISO8601:eventtime},%{WORD:Type},Item=(%{GREEDYDATA:Item}),%{GREEDYDATA:CID},TotalPass=%{NUMBER:TotalPass},TotalFail=%{NUMBER:TotalFail},SpreadFail=%{NUMBER:SpreadFail},RollingAvgFail=%{NUMBER:RollingAvgFail},%{GREEDYDATA:RollingAvgSMM},%{GREEDYDATA:RollingAvgLMM},%{GREEDYDATA:RollingAvgDynMoves},%{GREEDYDATA:RATRejects},%{GREEDYDATA:ETRejects},%{GREEDYDATA:SingleContFail},%{GREEDYDATA:SingleContFailAtCnsctv},BMKFail=%{NUMBER:BMKFail},,"
date {
match => ["eventtime","ISO8601"]

target => "eventdate"

  timezone => "UTC"


output {
stdout{codec => rubydebug}
elasticsearch {
hosts => [""]
index => "tol-pqr"
document_type => "vae0_5"

please help

(Mark Walkom) #2

It's not clear what your problem is?

(neal) #3

hi warkolm! i can't start the logstash,when run bin/logstash command,logstash can't parse the docuemnt and show :Default settings used: Filter workers: 2

(Mark Walkom) #4

What does this mean?
What do you expect?
What does the data look like?

(neal) #5

i mean the logstash don't work,it can't parse the document and print to screen

(Mark Walkom) #6

LS doesn't recursively look for files, add a * to the end of the path.

(neal) #7

thanks for prompt reply,i added * to the end of path,but it still shows "Default settings used: Filter workers: 2"

Don't i remove the older version (logstash 1.5) completely

(neal) #8

hi warkolm! logstash seems like nornal,but it can't import the documents (in /data/tmp/elktest/tollog/pqr/*) into index(toll-pqr) ,any sugguestion?

(Magnus B├Ąck) #9

Increase logging verbosity by starting Logstash with --verbose. For example, it might complain about not being able to read the files.

(system) #10