为什么文件信号无法连接到logstash

Question

我正在尝试将log4net日志发送到logstash进行解析，然后最终进入elasticsearch。我已将端口添加到Windows防火墙安全设置中，并允许所有连接到5044和9600。

在filebeat日志中，出现此错误

pipeline/output.go:100  Failed to connect to backoff(async(tcp://[http://hostname:5044]:5044)): lookup http://hostname:5044: no such host

Filebeat.yml（Logstash部分）

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["http://hostname:5044"]

  # Optional SSL. By default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client Certificate Key
  #ssl.key: "/etc/pki/client/cert.key"

#================================ Processors =====================================

Logstash.yml

我已将http.host设置为0.0.0.0

# ------------ Metrics Settings --------------
#
# Bind address for the metrics REST endpoint
#
 http.host: "0.0.0.0"
#
# Bind port for the metrics REST endpoint, this option also accept a range
# (9600-9700) and logstash will pick up the first available ports.
#
# http.port: 9600-9700

Logstash筛选器配置

input {
  beats {
    port => "5044"
  }
}

filter {
    if [type] == "log4net" {
        grok {
            match => [ "message", "%{TIMESTAMP_ISO8601:timestamp} \[%{NUMBER:threadid}\] %{WORD:level}\s*%{DATA:class} \[%{DATA:NDC}\]\s+-\s+%{GREEDYDATA:message}" ]
        }
        date {
            match => ["timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
            remove_field => ["timestamp"]
        }
        mutate {
            update => {
                "type" => "log4net-logs"
            }
        }
    }
}

output {
  elasticsearch {
    hosts => ["http://hostname:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    #user => "elastic"
    #password => "changeme"
  }
}

Answer 1

您可以尝试使用主机名：

hosts: ["hostname:5044"]

Answer 2

如@Adrian Dr所述，请尝试使用：

hosts: ["hostname:5044"]

但也将logstash绑定到单个端口：

http.port: 9600