Filebeat > Logstash > ElasticSearch - Lumberjack错误

Question

想让Filebeat和logstash一起工作。目前，我收到了以下错误：

2016/11/14 04:54:27.721478 output.go:109: DBG  output worker: publish 2047 events
2016/11/14 04:54:27.756650 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error
2016/11/14 04:54:27.756676 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error
2016/11/14 04:54:28.782729 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error
2016/11/14 04:54:28.782756 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error
2016/11/14 04:54:30.786983 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error
2016/11/14 04:54:30.787017 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error
2016/11/14 04:54:34.808528 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error
2016/11/14 04:54:34.808578 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error

有没有人有解决办法，或者你可以给我指明正确的方向？

Filebeat v5和logstash v5。

在本地做这个。

谢谢!

Answer 1

这可能是因为你的日志在你的文件中是看不见的。请以节拍作为输入启动您的日志。我已开始在第31311号港口存放日志。

    input {
  beats {
    host => "0.0.0.0"
    port => 31311
  }
}

filebeat.yml中的配置:默认情况下是ElasaticSearch输出。请注释它并取消日志存储输出配置。它应该如下所示。

output.logstash:
  # The Logstash hosts
  hosts: ["localhost:31311"]

如果您在这两者之间设置了任何身份验证，请注意。在完成此配置之后，我能够将我的消息显示在logstash中，并最终在Kibana看到。希望它能成功。