在其中添加過濾器塊時，Logstash管道失敗

我正在創建logstash管道，我將日志檔案作為輸入并在elasticsearch上讀取這些日志。我想geoip在我的 logstash 管道配置中添加過濾器，但是當我添加它時它失敗并關閉。

這是一個錯誤：

[2022-03-17T12:41:05,243][WARN ][logstash.outputs.elasticsearch][main] 
Elasticsearch Output configured with `ecs_compatibility => v8`, which 
resolved to an UNRELEASED preview of version 8.0.0 of the Elastic Common 
Schema. Once ECS v8 and an updated release of this plugin are publicly 
available, you will need to update this plugin to resolve this warning.
[2022-03-17T12:41:05,293][ERROR][logstash.javapipeline    ][main] 
Pipeline error {:pipeline_id=>"main", :exception=># 
<LogStash::ConfigurationError: GeoIP Filter in ECS-Compatiblity mode 
requires a `target` when `source` is not an `ip` sub-field, eg. [client] 
[ip]>, :backtrace=>["D:/logstash- 
8.1.0/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip-7.2.11- 
java/lib/logstash/filters/geoip.rb:143:in `auto_target_from_source!'", 
"D:/logstash-8.1.0/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip- 
7.2.11-java/lib/logstash/filters/geoip.rb:133:in `setup_target_field'", 
"D:/logstash-8.1.0/vendor/bundle/jruby/2.5.0/gems/logstash-filter-geoip- 
7.2.11-java/lib/logstash/filters/geoip.rb:108:in `register'", 
"org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in 
`register'", "D:/logstash-8.1.0/logstash- 
core/lib/logstash/java_pipeline.rb:232:in `block in register_plugins'", 
"org/jruby/RubyArray.java:1821:in `each'", "D:/logstash-8.1.0/logstash- 
core/lib/logstash/java_pipeline.rb:231:in `register_plugins'", 
"D:/logstash-8.1.0/logstash-core/lib/logstash/java_pipeline.rb:590:in 
`maybe_setup_out_plugins'", "D:/logstash-8.1.0/logstash- 
core/lib/logstash/java_pipeline.rb:244:in `start_workers'", 
"D:/logstash- 
8.1.0/logstash-core/lib/logstash/java_pipeline.rb:189:in `run'", 
"D:/logstash-8.1.0/logstash-core/lib/logstash/java_pipeline.rb:141:in `block in start'"], "pipeline.sources"=>["D:/logstash-8.1.0/my-logstash.conf"], :thread=>"#<Thread:0x6ea94258 run>"}
[2022-03-17T12:41:05,314][INFO ][logstash.javapipeline    ][main] Pipeline terminated {"pipeline.id"=>"main"}
[2022-03-17T12:41:05,357][INFO ][logstash.outputs.elasticsearch][main] Using a default mapping template {:es_version=>8, :ecs_compatibility=>:v8}
[2022-03-17T12:41:05,390][ERROR][logstash.agent           ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
[2022-03-17T12:41:05,499][DEBUG][logstash.instrument.periodicpoller.os] Stopping
[2022-03-17T12:41:05,523][DEBUG][logstash.instrument.periodicpoller.jvm] Stopping
[2022-03-17T12:41:05,525][DEBUG][logstash.instrument.periodicpoller.persistentqueue] Stopping
[2022-03-17T12:41:05,532][DEBUG] 
[logstash.instrument.periodicpoller.deadletterqueue] Stopping
[2022-03-17T12:41:05,556][DEBUG][logstash.agent           ] Shutting 
down all pipelines {:pipelines_count=>0}

當我在沒有過濾器的情況下使用以下配置時，它作業正常：

input {
 file {
  path => "D:/nest/es-logging-example/log/info/*.log"
  start_position => beginning
  sincedb_path => "NULL"
 }
}

output {
 elasticsearch {
    hosts => "localhost:9200"
    index => "myapplogs"
 }
 stdout{}
}

但是在組態檔中添加過濾器時它會失敗并關閉：

input { 
 file {
  path => "D:/nest/es-logging-example/log/info/*.log"
  start_position => beginning
  sincedb_path => "NULL"
  }
}
filter {
 geoip {
    source => "clientip"
 }
}
output {
  elasticsearch {
    hosts => "localhost:9200"
    index => "myapplogs"
  }
  stdout{}
}

我在第二個配置中做錯了什么？

uj5u.com熱心網友回復：

錯誤狀態是這樣的

ECS 兼容模式下的 GeoIP 過濾器需要targetwhensource不是ip子欄位。您只是缺少一個顯式target欄位

所以你的過濾器應該是這樣的：

filter {
 geoip {
    source => "clientip"
    target => "clientgeo"
 }
}

標籤：弹性搜索 日志存储 木花 麋鹿

上一篇：部署ElasticsearchSinkConnector后任務為空

下一篇：ElasticSearch:獲取每個檔案的最新版本