Logstash工作者无缘无故地死去

Question

使用logstash 2.3.4-1 on centos 7 with kafka-input plugin我有时会得到

{:timestamp =>"2016-09-07T13:41:46.437000 + 0000",:message =>#0,:events_consumed => 822,:worker_count => 1,:inflight_count => 0,:worker_states => [{ :status =>"dead",:alive => false,:index => 0,:inflight_count => 0}],:output_info => [{:type =>"http",:config => {"http_method" >>"post","url"=>"$ {APP_URL} /","headers"=> ["AUTHORIZATION","Basic $ {CREDS}"],"ALLOW_ENV"=> true},:is_multi_worker => false,:events_received => 0,:workers =>"",headers => {..},codec =>"UTF-8">,workers => 1,request_timeout => 60,socket_timeout => 10,connect_timeout = > 10,follow_redirects => true,pool_max => 50,pool_max_per_route => 25,keepalive => true,automatic_retries => 1,retry_non_idempotent => false,validate_after_inactivity => 200,ssl_certificate_validation => true,keystore_type =>"JKS", truststore_type =>"JKS",cookies => true,verify_ssl => true,format =>"json">]>,:busy_workers => 1},{:type =>"stdout",:config => {"ALLOW_ENV "=> true} ,: is_multi_worker => false,:events_received => 0,:workers =>"\n">,workers => 1>]>,:busy_workers => 0}],:thread_info => [ ],:stalling_threads_info => []}>,:level =>:warn}

这是配置

        input {
      kafka {
        bootstrap_servers => "${KAFKA_ADDRESS}"
        topics => ["${LOGSTASH_KAFKA_TOPIC}"]
      }
    }

    filter {
      ruby {
        code =>
      "require 'json'
       require 'base64'

       def good_event?(event_metadata)
         event_metadata['key1']['key2'].start_with?('good')
       rescue
         true 
       end

       def has_url?(event_data)
         event_data['line'] && event_data['line'].any? { |i| i['url'] && !i['url'].blank? }
       rescue
         false
       end

       event_payload = JSON.parse(event.to_hash['message'])['payload']

       event.cancel unless good_event?(event_payload['event_metadata'])
       event.cancel unless has_url?(event_payload['event_data'])
    "
  }
    }

    output {
      http {
          http_method => 'post'
          url => '${APP_URL}/'
          headers => ["AUTHORIZATION", "Basic ${CREDS}"]
      }

      stdout { }
    }

这很奇怪,因为它写入logstash.log而不是logstash.err

这个错误意味着什么,我该如何避免呢？(只有重启logstash解决它,直到下次发生)

Answer 1

根据这个github问题,你的ruby代码可能导致问题.基本上任何ruby异常都会导致过滤器工作者死亡.如果没有看到你的ruby代码,就不可能进一步调试,但你可以尝试将ruby代码包装在异常处理程序中并在某处记录异常(至少在更新logstash以记录它之前).