# Filebeat, Logstash и ротация логов

**URL:** <https://discuss.elastic.co/t/filebeat-logstash/115868>\
**Category:** Вопросы на русском языке\
**Created:** [January 17, 2018, 11:10am UTC](https://discuss.elastic.co/t/filebeat-logstash/115868 "2018-01-17T11:10:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![uliana\_andreeva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/uliana_andreeva/32/26656_2.png) [@uliana\_andreeva](https://discuss.elastic.co/u/uliana_andreeva)\
**Post date:** [January 17, 2018, 11:10am UTC](https://discuss.elastic.co/t/filebeat-logstash/115868/1 "2018-01-17T11:10:42Z")

</div>

Всем привет! Я новичок в ELK. Есть сервер с CentOs 7, на нем установлен ELK 6.1, настроен Filebeat:

```
filebeat.prospectors:
- type: log
  paths:
    - /opt/tomcat/logs/calendar/log.log
  exclude_lines: ['^org.springframework.']

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 3

setup.kibana:
  host: "localhost:5601"

output.logstash:
  hosts: ["localhost:5044"]

```

Конфиг Logstash:

```
input {
    beats {
        port => "5044"
    }
}
filter {
    grok {
      match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{SYSLOG5424SD:thread} %{SYSLOGHOST:logger} \[%{JAVACLASS:class}\:%{NUMBER:javaline}\] %{GREEDYDATA:message}" }
      overwrite => ["message"]
    }
}
filter {
    date {
      match => ["timestamp", ISO8601]
    }
}
output {
    elasticsearch {
      hosts => ["http://localhost:9200"]
      index => "calendar7-%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    }
    stdout { codec => rubydebug }
}

```

Вчера запустила ./logstash -f calendar.conf, в Kibana появился нужный индекс, логи обновлялись корректно. Сегодня в Kibana пусто, то есть вчерашний индекс есть, сегодняшнего нет, логов соответственно тоже. Запустила еще раз ./logstash -f calendar.conf - индекс появился, логи вижу. Помогите, пожалуйста, разобраться, в чем проблема? Спасибо!

---

<div class="post-metadata">

**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\
**Post date:** [January 17, 2018, 3:12pm UTC](https://discuss.elastic.co/t/filebeat-logstash/115868/2 "2018-01-17T15:12:04Z")

</div>

Может logstash за ночь упал и не пере-стартовал. Что в логах logstash видно?

---

<div class="post-metadata">

**Author:** ![uliana\_andreeva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/uliana_andreeva/32/26656_2.png) [@uliana\_andreeva](https://discuss.elastic.co/u/uliana_andreeva)\
**Post date:** [January 17, 2018, 4:26pm UTC](https://discuss.elastic.co/t/filebeat-logstash/115868/3 "2018-01-17T16:26:38Z")

</div>

спасибо за ответ. да, вы правы! он упал с ошибкой:

[2018-01-16T19:15:04,074][FATAL][logstash.runner] An unexpected error occurred! {:error=\>#\<SystemCallError: Unknown error (SystemCallError) - \>, :backtrace=\>["org/jruby/RubyIO.java:1457:in `write'", "org/jruby/RubyIO.java:1428:in`write'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-stdout-3.1.3/lib/logstash/outputs/stdout.rb:44:in `block in multi_receive_encoded'", "org/jruby/RubyArray.java:1734:in`each'", "/usr/share/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-stdout-3.1.3/lib/logstash/outputs/stdout.rb:43:in `multi_receive_encoded'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:90:in`multi\_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output\_delegator\_strategies/single.rb:15:in `block in multi_receive'", "org/jruby/ext/thread/Mutex.java:148:in`synchronize'", "/usr/share/logstash/logstash-core/lib/logstash/output\_delegator\_strategies/single.rb:14:in `multi_receive'", "/usr/share/logstash/logstash-core/lib/logstash/output_delegator.rb:50:in`multi\_receive'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:487:in `block in output_batch'", "org/jruby/RubyHash.java:1343:in`each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:486:in `output_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:438:in`worker\_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:393:in `block in start\_workers'"]}

отключила вывод stdout { codec =\> rubydebug }, посмотрю, что будет дальше

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 14, 2018, 4:27pm UTC](https://discuss.elastic.co/t/filebeat-logstash/115868/4 "2018-02-14T16:27:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.