# Не данных в файле после обработки в logstash

**URL:** <https://discuss.elastic.co/t/logstash/183071>\
**Category:** Вопросы на русском языке\
**Created:** [May 28, 2019, 10:56am UTC](https://discuss.elastic.co/t/logstash/183071 "2019-05-28T10:56:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![GAV](https://avatars.discourse-cdn.com/v4/letter/g/d2c977/32.png) [@GAV](https://discuss.elastic.co/u/GAV)\
**Post date:** [May 28, 2019, 10:56am UTC](https://discuss.elastic.co/t/logstash/183071/1 "2019-05-28T10:56:04Z")

</div>

Добрый день!!!

Я новичок в данной программы, прошу помощи у гуру logstash.

Файл не имеет данных !!!!

Конфиг logstash

input {

```
    udp {
            port => 8516
    }

```

}

filter {

```
    grok {
            break_on_match => false
            match => { "message" => ["(?m)%{GREEDYDATA:data}"]
            }
    }

```

}

output {

```
    if [data] {
            file {
                    path => "/var/lib/logstash/%{+yyyy}/%{+yyyy-MM-dd}.csv"
                    codec => line { format => "%{data}" }
            }
    }

```

}

данные на порту

13:57:09.255719 IP (tos 0x1c, ttl 124, id 54321, offset 0, flags [none], proto UDP (17), length 518)  
109.195.80.76.64488 \> 188.186.156.234.8516: [udp sum ok] UDP, length 490  
E....1..|.P.m.PL......!D.........R...0.[{.LD.!.(.......m.PL..8c:83:e1:61:3a:30..  
.L^..8c:83:e1:61:3a:30 .bsr01-spb,.EF11D40E53DFA35CED0AD5.... .2.EF11D40E54AA2A5CED11497....=.....W.lag-1:754.36.SLA-REDIRECT..8c:83:e1:61:3a:30/....._.....0....8+....2......k.0x8001 minimalt...........v...........k.0x8002 minimalt...........v.............0x8001 minimalu...........w.............0x8002 minimalu..........2w..........8  
13:57:09.259798 IP (tos 0x1c, ttl 124, id 54321, offset 0, flags [none], proto UDP (17), length 426)  
109.195.80.76.64488 \> 188.186.156.234.8516: [udp sum ok] UDP, length 398  
E....1..|.QAm.PL......!D........n..~.T..R\>c.9.&.(.......m.PL..48:2c:a0:6b:12:1c..  
.V...48:2c:a0:6b:12:1c .bsr01-spb,.EF11D40E541EAD5CED0CDD.....(2.EF11D40E5500055CED14057....=.....W.lag-1:760.3600.SLA-REDIRECT..48:2c:a0:6b:12:1c/....._.....0.....+......J....k.0x8001 no-statsk.0x8002 no-stats..0x8001 no-stats..0x8002 no-stats

Файл csv не создается

ЛОГ  
[2019-05-28T13:59:24,127][WARN][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified  
[2019-05-28T13:59:24,145][INFO][logstash.runner] Starting Logstash {"logstash.version"=\>"7.1.0"}  
[2019-05-28T13:59:30,715][INFO][logstash.javapipeline] Starting pipeline {:pipeline\_id=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>50, "pipeline.max\_inflight"=\>500, :thread=\>"#\<Thread:0x2cce1a  
[2019-05-28T13:59:30,763][INFO][logstash.javapipeline] Pipeline started {"pipeline.id"=\>"main"}  
[2019-05-28T13:59:30,871][INFO][logstash.inputs.udp] Starting UDP listener {:address=\>"0.0.0.0:8516"}  
[2019-05-28T13:59:30,903][INFO][logstash.agent] Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}  
[2019-05-28T13:59:31,001][INFO][logstash.inputs.udp] UDP listener started {:address=\>"0.0.0.0:8516", :receive\_buffer\_bytes=\>"62464", :queue\_size=\>"2000"}  
[2019-05-28T13:59:31,233][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

---

<div class="post-metadata">

**Author:** ![GAV](https://avatars.discourse-cdn.com/v4/letter/g/d2c977/32.png) [@GAV](https://discuss.elastic.co/u/GAV)\
**Post date:** [May 29, 2019, 6:53am UTC](https://discuss.elastic.co/t/logstash/183071/2 "2019-05-29T06:53:39Z")

</div>

Коллеги подскажите почему не могу разобрать, эти данные ?????

---

<div class="post-metadata">

**Author:** ![GAV](https://avatars.discourse-cdn.com/v4/letter/g/d2c977/32.png) [@GAV](https://discuss.elastic.co/u/GAV)\
**Post date:** [May 29, 2019, 8:31am UTC](https://discuss.elastic.co/t/logstash/183071/3 "2019-05-29T08:31:45Z")

</div>

Вопрос решен не актуально

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 26, 2019, 8:31am UTC](https://discuss.elastic.co/t/logstash/183071/4 "2019-06-26T08:31:51Z")

</div>

Closed on June 26, 2019, 8:31am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.