Logstash input file to es

Elastic Stack Logstash
1

i test a file output to ES, and i use "/usr/share/logstash/bin/logstash -f testlog.conf", the data output to ES, it's working and i Ctrl+c , and systemctl restart logstash. the data no output to ES.
i don't know what is the reason? who can help me
the ES'version is 6.3.2 and the logstash'version is 6.3.2, they have been installed on the same VM.
thanks

the test log file is very simple

"djdj
djdfdv
214,e
1234
45687
4848
djdjd
djdj"

the test "conf" file is very simple.

input
{
file
{
path => "/root/testlog/*.log"
start_position => "beginning"
type => "testlog"
}
}
output
{
elasticsearch {
hosts => ["172.32.1.60:9200"]
index => "logstash-testlog-%{+YYYY.MM.dd}"
}
# stdout { codec => rubydebug }
}

2

Hi @jianming,

I think you have to check with stdout command if the logs are getting or not ?

Thanks & Regards,
Krunal.

3

i use stdout { codec => rubydebug }, it's ok. and i change output to ES. and run command "/usr/share/logstash/bin/logstash -f testlog.conf " , it's work. In the kibana can be created the index. all things is work.
but i don't use command. just use "systemctl start logstash". the data can't be output to ES. kibana haven't any index information ,so can't be create index. i see the logstash log, no error.
i know what is the reason ?

thanks

4

Ok.

Do one thing remove file { path } and try with stdin and then see data will sending in ES or not.

Thanks & Regards,
Krunal.

5

i try use " /usr/share/logstash/bin/logstash -e 'input { stdin {} } output { elasticsearch { hosts => ["172.32.1.60:9200"] index => "testlog-%{+YYYY.MM.dd}" }}' "
it's work.
and i used root account to login and restart logstash.service,whether it's related to the root account?

6

i use /var/log/messages for input file, i use "systemctl restart logstash " to start logstash.service ,it's work. and the data output to ES.
why i create the file, logstash can't output to ES ? i modify the file's right. 644.
i don't know what's the reason ?

input {
file
{
path => "/var/log/messages"
start_position => "beginning"
type => "messagelog"
}
}

output
{
elasticsearch {
hosts => ["172.32.1.60:9200"]
index => "logstash-messageslog-%{+YYYY.MM.dd}"
}

}
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.