logstash sincedb_path 不工作答案

【问题标题】：logstash sincedb_path is not workinglogstash sincedb_path 不工作
【发布时间】：2018-02-15 04:41:16
【问题描述】：

这不起作用。没有输出。我想使用 sincedb_path => "/mnt/elk/logstash/scripts/sincedb/from_nifi_dev_logs_nifi_6

sudo rm -rf /mnt/elk/logstash/scripts/sincedb/from_nifi_dev_logs_nifi_6

sudo /usr/share/logstash/bin/logstash -e 'input { file { path => "/mnt/elk/logstash/data/from/nifi/dev/logs/nifi_copied/nifi-app.log"  sincedb_path => "/mnt/elk/logstash/scripts/sincedb/from_nifi_dev_logs_nifi_6" } } output { stdout { codec => rubydebug } }' --verbose

默认目录下没有sincedb文件。

ls /usr/share/logstash/data/plugins/inputs/file
no files

这是有效的。我不想使用 start_position => 开始 sincedb_path => "/dev/null"

sudo /usr/share/logstash/bin/logstash -e 'input { file { path => "/mnt/elk/logstash/data/from/nifi/dev/logs/nifi_copied/nifi-app.log"  start_position => beginning sincedb_path => "/dev/null" } } output { stdout { codec => rubydebug } }' --verbose  
{
      "@version" => "1",
          "host" => "hostname",
          "path" => "/mnt/elk/logstash/data/from/nifi/dev/logs/nifi_copied/nifi-app.log",
    "@timestamp" => 2018-02-07T19:24:31.758Z,
       "message" => "Caused by: java.io.IOException: null"
}

【问题讨论】：

标签： logstash

【解决方案1】：

您想将 start_position => beginning 添加到您的命令中。

来自Elasticsearch

start_position：默认行为将文件视为实时流，因此从末尾开始。如果您有要导入的旧数据，请将其设置为开头。

运行这个命令：

sudo /usr/share/logstash/bin/logstash -e 'input { file { path => "/mnt/elk/logstash/data/from/nifi/dev/logs/nifi_copied/nifi-app.log" start_position => beginning sincedb_path => "/mnt/elk/logstash/scripts/sincedb/from_nifi_dev_logs_nifi_6" } } output { stdout { codec => rubydebug } }' --verbose

另外，请确保 from_nifi_dev_logs_nifi_6 是文件而不是目录。

来自Elasticsearch

sincedb_path:sincedb 数据库文件的路径... 注意：它必须是文件路径而不是目录路径

【讨论】：