version : logstash 5.0.2 \elasticsearch 5.0.2
1.My configuration file in /etc/logstash/config.d/test.conf:
input {
file{
path => "/home/installer/test//logs/test_client.log"
}
}
filter {
grok {
match => {"message"=>"%{TIMESTAMP_ISO8601:timestamp} %{DATA:thread_name} %{LOGLEVEL:level} %{DATA:component} %{HOSTNAME:instance} %{JAVACLASS:logger_name} %{NOTSPACE:slm} %{GREEDYDATA:log_message}"}
}
json {
source => "slm"
target => "context"
remove_field => ["slm"]
}
}
output {
elasticsearch{
hosts=>["10.175.193.176:9200"]
index=>"lwm2m-server-%{+YYYY.MM.dd}"
}
stdout { codec => rubydebug }
}
2.And my test_client.log file had some log message.
I used command start logstash : sudo initctl start logstash ,and logstash is running.
But,elasticsearch no messages from 'logastsh' were received。
However,I used command to start logstash : ./bin/logstash -f test.conf
the elasticsearch can receive messages from 'logastsh'。
Why?
Does anybody know what's going on?