elasticsearch - Input as file path in logstash config didn't work -
when run command this(on windows system):
logstash -f logstash-apache.conf
there's no output , didn't store log elasticsearch. think didn't work. btw refered website:https://www.elastic.co/guide/en/logstash/current/config-examples.html#config-examples
this conf file(logstash-apache.conf):
input { file { path => ["c:/users/user/downloads/logstash-5.5.1/bin/access_log.txt"] start_position => "beginning" } } filter { if [path] =~ "access" { mutate { replace => { "type" => "apache_access" } } grok { match => { "message" => "%{combinedapachelog}" } } } date { match => [ "timestamp" , "dd/mmm/yyyy:hh:mm:ss z" ] } } output { elasticsearch { hosts => ["localhost:9200"] } stdout { codec => rubydebug } }
this output: c:\users\user\downloads\logstash-5.5.1\bin>logstash -f logstash-apache.conf error statuslogger no log4j2 configuration file found. using default configuration: logging errors console. sending logstash's logs c:/users/user/downloads/logstash-5.5.1/logs configured via log4j2.properties [2017-08-18t08:35:20,504][info ][logstash.outputs.elasticsearch] elasticsearch pool urls updated {:changes=>{:removed=>[], :added=>[localhost:9200/]}} [2017-08-18t08:35:20,509][info ][logstash.outputs.elasticsearch] running health check see if elasticsearch connection working {:healthcheck_url=>localhost:9200/, :path=>"/"} [2017-08-18t08:35:20,668][warn ][logstash.outputs.elasticsearch] restored connection es instance {:url=>#} [2017-08-18t08:35:20,670][info ][logstash.outputs.elasticsearch] using mapping template {:path=>nil} [2017-08-18t08:35:20,725][info ][logstash.outputs.elasticsearch] attempting install template {:manage_template=>{"template"=>"logstash-", "version"=>50001, "settings"=>{"index.refresh_interval"=>"5s"}, "mappings"=>{"_default_"=>{"_all"=>{"enabled"=>true, "norms"=>false}, "dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date", "include_in_all"=>false}, "@version"=>{"type"=>"keyword", "include_in_all"=>false}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}} [2017-08-18t08:35:20,734][info ][logstash.outputs.elasticsearch] new elasticsearch output {:class=>"logstash::outputs::elasticsearch", :hosts=>[#]} [2017-08-18t08:35:21,010][info ][logstash.pipeline ] starting pipeline {"id"=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>500} [2017-08-18t08:35:21,896][info ][logstash.pipeline ] pipeline main started [2017-08-18t08:35:22,036][info ][logstash.agent ] started logstash api endpoint {:port=>9600}
thank in advance :)
Comments
Post a Comment