Filebeat> Logstash> ElasticSearch - Lumberjack错误

Question

试图让Filebeat与logstash一起使用.目前我收到此错误:

2016/11/14 04:54:27.721478 output.go:109: DBG  output worker: publish 2047 events
2016/11/14 04:54:27.756650 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error
2016/11/14 04:54:27.756676 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error
2016/11/14 04:54:28.782729 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error
2016/11/14 04:54:28.782756 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error
2016/11/14 04:54:30.786983 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error
2016/11/14 04:54:30.787017 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error
2016/11/14 04:54:34.808528 sync.go:85: ERR Failed to publish events caused by: lumberjack protocol error
2016/11/14 04:54:34.808578 single.go:91: INFO Error publishing events (retrying): lumberjack protocol error

有没有人有解决方案或者你可以指出我正确的方向？

Filebeat v5和logstash v5.

在本地这样做.

谢谢!

Answer 1

可能是因为您的logstash对您的文件标签不可见.请以节拍作为输入开始您的logstash.我在第31311号端口上启动了我的logstash.

    input {
  beats {
    host => "0.0.0.0"
    port => 31311
  }
}

filebeat.yml中的配置:默认情况下是ElasaticSearch输出.请对其进行评论并取消注释logstash输出配置.它应该如下所示.

output.logstash:
  # The Logstash hosts
  hosts: ["localhost:31311"]

如果您在这两者之间设置了任何身份验证,请注意.在完成此配置后,我能够将我的消息看到logstash,最后在Kibana中.希望它会奏效.