传英文日志都没事，但是穿中文日志就不行 报错
Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-test-chienx", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x383a1289>], :response=>{"index"=>{"_index"=>"logstash-test-chienx", "_type"=>"doc", "_id"=>"RRyRxmUBFMZRtaMkrPy6", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [time]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"2018-09-10 23:49:30\" is malformed at \" 23:49:30\""}}}}}
4 个回复
juin - 大数据开发
赞同来自:
chienx
赞同来自:
file{
path =>"C:/Users/chenxi/Desktop/sys/Logs/statisticLog2018_09_10.txt"
start_position=>"beginning"
}
}
filter {
grok {
match => {
"message" => "\s*\[%{TIMESTAMP_ISO8601:time}\]"
}
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ]
}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
index => "logstash-test-%{host}"
}
stdout { codec => rubydebug }
}
chienx
赞同来自:
Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-test-chienx", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x383a1289>], :response=>{"index"=>{"_index"=>"logstash-test-chienx", "_type"=>"doc", "_id"=>"RRyRxmUBFMZRtaMkrPy6", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [time]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"2018-09-10 23:49:30\" is malformed at \" 23:49:30\""}}}}}
chienx
赞同来自: