Logstash 中的配置错误

Question

当我运行这个配置文件时：

input {
  file {
    path => "/tmp/linuxServerHealthReport.csv"
    start_position => "beginning"
    sincedb_path => "/home/infra/logstash-7.14.1/snowdb/health_check"
  }
  codec => multiline {
    pattern => "\""
    negate => true
    what => previous
  }
}

filter {
  csv {
    columns => ["Report_timestamp","Hostname","OS_Relese","Server_Uptime","Internet_Status","Current_CPU_Utilization","Current_Memory_Utilization","Current_SWAP_Utilization","FS_Utilization","Inode_Utilization","FS_Read_Only_Mode_Status","Disk_Multipath_Status","Besclient_Status","Antivirus_Status","Cron_Service_Status","Nagios_Status","Nagios_Heartbest_Status","Redhat_Cluster_Status"]
    separator => ","
    skip_header => true
  }
  mutate {
    remove_field => ["path", "host"]
  }
  skip_empty_columns => true
  skip_empty_row => true
}

# quote_char => "'"

output {
  stdout { codec => rubydebug }
}

我收到此错误：

错误： [2021-09-22T15:57:04,929][ERROR][logstash.agent] 无法执行操作 {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError" , :message=>“在输入 {\n 文件 {\n\t\tpath => 后，第 7 行第 9 列（字节 226）应为 [ \t\r\n]、“#”、“{”之一"/tmp/linuxServerHealthReport.csv"\n start_position => "开始"\n sincedb_path => "/home/imiinfra/logstash-7.14.1/snowdb/health_check"\n }\n\t\tcodec ", :backtrace =>["/home/imiinfra/logstash-7.14.1/logstash-core/lib/logstash/compiler.rb:32:in compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:187:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:在initialize'", "/home/imiinfra/logstash-7.14.1/logstash-core/lib/logstash/java_pipeline.rb:47:in initialize'", "/home/imiinfra/logstash-7.14.1/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute'", "/home/imiinfra/logstash-7.14.1/logstash-core/lib/logstash/agent.rb:391:in block inverge_state'"]}

Answer 1

你必须处理你的格式，但这是我从问题中重建的。主要问题似乎是file 的参数，您出于某种原因将codec 放在file 之外。另一个问题是csv 参数skip_empty_columns 和skip_empty_row 也在csv 之外。

所以我做了一些格式化并修复了这些问题，它现在应该可以工作了。

input {
  file {
    path => "/tmp/linuxServerHealthReport.csv"
    codec => multiline {
      pattern => "\""
      negate => true
      what => previous
    }
    start_position => "beginning"
    sincedb_path => "/home/infra/logstash-7.14.1/snowdb/health_check"
  }
}

filter {
  csv {
    columns => ["Report_timestamp","Hostname","OS_Relese","Server_Uptime","Internet_Status","Current_CPU_Utilization","Current_Memory_Utilization","Current_SWAP_Utilization","FS_Utilization","Inode_Utilization","FS_Read_Only_Mode_Status","Disk_Multipath_Status","Besclient_Status","Antivirus_Status","Cron_Service_Status","Nagios_Status","Nagios_Heartbest_Status","Redhat_Cluster_Status"]
    separator => ","
    skip_header => true
    skip_empty_columns => true
    skip_empty_row => true
  }
  mutate {
    remove_field => ["path", "host"]
  }
}

output {
  stdout { codec => rubydebug }
}