搜索结果正在快递途中

logstash无法向es传中文

Logstash | 作者 chienx | 发布于2018年09月11日 | 阅读数:2017

logstash读取中文日志 ,能在控制台输出,但是不能再es中输出 ,求大佬告诉是为啥
已邀请:

juin - 大数据开发

赞同来自:

logstash 配置文件啥样

chienx

赞同来自:

input {
    file{
        path =>"C:/Users/chenxi/Desktop/sys/Logs/statisticLog2018_09_10.txt"
        start_position=>"beginning"
    }

filter {
  grok {
        match => {
             "message" => "\s*\[%{TIMESTAMP_ISO8601:time}\]"
}
add_field => [ "received_at", "%{@timestamp}" ]
add_field => [ "received_from", "%{host}" ] 
    }
    
}
output {
    elasticsearch {
         hosts => ["localhost:9200"]
index => "logstash-test-%{host}"
        }
   stdout { codec => rubydebug }
}
 

chienx

赞同来自:

传英文日志都没事,但是穿中文日志就不行 报错
Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-test-chienx", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x383a1289>], :response=>{"index"=>{"_index"=>"logstash-test-chienx", "_type"=>"doc", "_id"=>"RRyRxmUBFMZRtaMkrPy6", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [time]", "caused_by"=>{"type"=>"illegal_argument_exception", "reason"=>"Invalid format: \"2018-09-10 23:49:30\" is malformed at \" 23:49:30\""}}}}}

chienx

赞同来自:

目前暂时已经解决了 ,去掉index里面的%{host}就能传过去,具体原因尚不明确,希望了解的大佬能解释一下

要回复问题请先登录注册