配置与输出文件和编解码器不解析logstash

Question

我正在尝试一个“简单”logstash配置，并希望输出到一个文件进行检查。所以，我把从CONF和https://www.elastic.co/guide/en/logstash/current/plugins-outputs-file.html把它放在我的conf：

input {                                                         
    file { 
    exclude => ['*.gz'] 
    path => ['/var/log/*.log'] 
    type => 'system logs' 
    } 
    syslog { 
    port => 5000 
    } 
} 

output { 
    elasticsearch { 
    hosts => ['elasticsearch'] 
    } 

    file { 
    path => "/config/logstash_out.log" 
    codec => { 
     line { 
     format => "message: %{message}" 
     } 
    } 
    } 

    stdout {} 
} 

但是当我启动它（sudo docker run -it --rm --name logstash -p 514:5000 --link elasticsearch:elasticsearch -v "$PWD":/config logstash logstash -f /config/logstash.conf），我得从logstash投诉：

fetched an invalid config 
{:config=>"input { 
    file { 
    exclude => ['*.gz'] 
    path => ['/var/log/*.log'] 
    type => 'system logs' 
    } 
    syslog { 
    port => 5000 
    } 
} 
output { 
    elasticsearch { 
    hosts => ['elasticsearch'] 
    } 

    file { 
    path => \"/config/logstash_out.log\" 
    codec => { 
     line { 
     format => \"message: %{message}\" 
     } 
    } 
    } 

    stdout {} 
}" 
, :reason=>"Expected one of #, => at line 20, column 13 (byte 507) 
after output { elasticsearch {\n hosts => ['elasticsearch']\n } 
\n\n file {\n path => \"/config/logstash_out.log\"\n  
codec => { \n  line ", :level=>:error} 

（我重新格式化了一下，所以它更具可读性）

任何想法为什么？ I'seen logstash output to file and ignores codec但建议的解决方案标记为DEPRECATED，所以我想避免

谢谢！

Answer 1

与教程类似，您的格式不正确。 这是the pull request。

这不是

codec => { 
     line { 
     format => \"message: %{message}\" 
     } 
    } 

但

codec => 
     line { 
     format => "message: %{message}" 
     } 

你并不需要添加一行左右括号quirly。

这是你的配置正确。

input {                                                         
    file { 
    exclude => ['*.gz'] 
    path => ['/var/log/*.log'] 
    type => 'system logs' 
    } 
    syslog { 
    port => 5000 
    } 
} 

output { 
    elasticsearch { 
    hosts => ['elasticsearch'] 
    } 

    file { 
    path => "/config/logstash_out.log" 
    codec => 
     line { 
     format => "message: %{message}" 
     } 

    } 

    stdout {} 
}