启动logstash的grok过滤器出错

Question

我有以下logstash conf文件

input {
  tcp {
    port => 12345
    codec => json
  }
}

filter {
  grok {
    break_on_match => true
    match => [
        "message", "%{TIMESTAMP_ISO8601:timestamp} (verbose|info|debug) (hostd|vpxa)",
    ]
    mutate {
      add_tag => "esxi_verbose"
    }
  }
}

if "esxi_verbose" in [tags] {
  drop{}
}

output {
      stdout { codec => rubydebug }
      elasticsearch { 
        hosts => ["localhost:9200"] 
        index => "logstash-%{+YYYY.MM.dd}"
      }
}

我试图删除任何详细，调试，信息消息。当我开始logstash时，我收到错误

[2019-03-03T16:53:11,731][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, \", ', -, [, { at line 13, column 5 (byte 211) after filter {\n  grok {\n    break_on_match => true\n    match => [\n        \"message\", \"%{TIMESTAMP_ISO8601:timestamp} (verbose|info|debug) (hostd|vpxa)\",\n    "

有人可以帮我解决我做错了什么。

Answer 1

你在配置中有3个问题：

1. 在grok消息行的末尾有一个逗号是冗余的
2. mutate在grok过滤器内部，但它应该在它之后
3. 'if'语句应该在'filter'部分内。

这是更新且有效的配置：

input {
  tcp {
    port => 12345
    codec => json
  }
}

filter {
  grok {
    break_on_match => true
    match => [
        "message", "%{TIMESTAMP_ISO8601:timestamp} (verbose|info|debug) (hostd|vpxa)"
    ]
  }

  mutate {
    add_tag => "esxi_verbose"
  }

  if "esxi_verbose" in [tags] {
    drop{}
  }

}

output {
      stdout { codec => rubydebug }
      elasticsearch {
        hosts => ["localhost:9200"]
        index => "logstash-%{+YYYY.MM.dd}"
      }
}