无法获取kibana中的索引相关数据

Question

我可以使用logstash.conf创建索引。我的输入类型是gelf。我要把日志发送给基巴纳。这是我的logstash.conf

input 
{ gelf { } 
} 
output 

{
 stdout { codec => rubydebug }
 elasticsearch {
  hosts =>  ["elk.lera.com:80"]
  index => "templeton-math-%{+YYYY.MM.dd}"
 }

elasticsearch {
  hosts =>  ["elk.lera.com:80"]
  index => "templeton-science-%{+YYYY.MM.dd}"
 }
 elasticsearch {
  hosts =>  ["elk.lera.com:80"]
  index => "templeton-bio-%{+YYYY.MM.dd}"
 }
 elasticsearch {
  hosts =>  ["elk.lera.com:80"]
  index => "templeton-lang-%{+YYYY.MM.dd}"
 }
}

问题:日志现在被发送到所有的索引。我想把日志发送到各自的索引。

我已经添加了如下内容

if[tag] == "templeton-math"{
elasticsearch {
  hosts =>  ["elk.lera.com:80"]
  index => "templeton-math-%{+YYYY.MM.dd}"
 }
}

它给出了一个错误信息logstash.agent -找不到持久的UUID文件。正在生成新的UUID {:uuid=>"67f7a48e-fc7c-499b-85a0-3fd6979f88f6"，:path=>"/var/lib/logstash/uuid"} 14:58:14.308 LogStash::Runner错误logstash.agent -输出后无法创建管道{：reason=>“在第22行，第9列(字节179)处应为#，=>之一\n\n {\n \n elasticsearch {\n hosts "} 2017-10-11 14:58:14,355 Api lib服务器错误未找到log4j2配置文件。使用默认配置:仅将错误记录到控制台。

Answer 1

尝尝这个。

output {
    stdout { codec => rubydebug }

    if [tag] == "templeton-math" {
        elasticsearch {
            hosts =>  ["elk.lera.com:80"]
            index => "templeton-math-%{+YYYY.MM.dd}"
        }
    }

    if [tag] == "templeton-science" {
        elasticsearch {
            hosts =>  ["elk.lera.com:80"]
            index => "templeton-science-%{+YYYY.MM.dd}"
        }
    }

    if [tag] == "templeton-bio" {
        elasticsearch {
            hosts =>  ["elk.lera.com:80"]
            index => "templeton-bio-%{+YYYY.MM.dd}"
        }

    }

    if [tag] == "templeton-lang" {
        elasticsearch {
            hosts =>  ["elk.lera.com:80"]
            index => "templeton-lang-%{+YYYY.MM.dd}"
        }
    }
}