我无法在kibana中查看日志，或者无法使用logstash将日志添加到elasticseach

Question

我启动kibana，elastiksearch和logstash我写简单的服务器：

@Slf4j
@RestController
public class TestController {

  @GetMapping(value = "/test")
  public String test(){

    log.debug("test");

    return "OK";
  }
}

添加appender：

<appender name="STASH" class="ch.qos.logback.core.rolling.RollingFileAppender">
    <file>test.log</file>
    <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
      <fileNamePattern>redditApp.%d{yyyy-MM-dd}.log</fileNamePattern>
      <maxHistory>7</maxHistory>
    </rollingPolicy>
    <encoder class="net.logstash.logback.encoder.LogstashEncoder"/>
  </appender>

当我启动服务器时 - 使用JSON类型的日志创建test.log文件。当我打电话给/test - 在test.log添加线：

{"@timestamp":"2018-08-07T14:36:08.624+03:00","@version":"1","message":"test","logger_name":"com.example.logs.controllers.TestController","thread_name":"http-nio-8080-exec-1","level":"DEBUG","level_value":10000}

之后，我想通过logstash解析此文件并将所有日志添加到elasticsearch。我将配置添加到logstash：

input {
    file {
        path => "D:\projects\logs\*.log"
        codec => "json"
        type => "logback"
    }
}

output {
    if [type]=="logback" {
         elasticsearch {
             hosts => [ "localhost:9200" ]
             index => "logback-%{+YYYY.MM.dd}"
        }
    }
}

并开始logstash。它开始成功了。

之后我打开kibana我不明白我怎么能看到日志。

Answer 1

[type]已被弃用。从输出中删除它：

output {
     elasticsearch {
         hosts => [ "localhost:9200" ]
         index => "logback-%{+YYYY.MM.dd}"
    }
}

编辑：和你的输入。实际上，尝试使用标签：

input {
    file {
        path => "D:\projects\logs\*.log"
        codec => "json"
        tags => ["logback"]
    }
}

output {
    if "logback" in tags {
         elasticsearch {
             hosts => [ "localhost:9200" ]
             index => "logback-%{+YYYY.MM.dd}"
        }
    }
}