时间戳

首页 > 解决方案 > udp 插件中的 Logstash 多行编解码器抛出错误

logstash - udp 插件中的 Logstash 多行编解码器抛出错误

问题描述

我正在尝试处理生成多行系统日志数据的logstash 摄取。例子：

事件编号：1234

消息：ABCD

严重性：高

我需要将日志的最终输出作为事件 ID：1234 消息：ABCD 严重性：高。

我尝试使用带有多行编解码器的 UDP 输入插件并抛出如下错误：

[FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<LogStash::Error: Don't know how to handle `Java::JavaLang::IllegalStateException` for `PipelineAction::Create<pipeline-blah>, :backtrace=> ["org/logstash/execution/ConvergeResultExt.java:109:in `create'", "org/logstash/execution/ConvergeResultExt.java:37:in `add'", "/opt/blah/logstash-7.4.2/logstash-core/lib/logstash/agent.rb:339:in `block in converge_state'"]}

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:pipeline-blah, :exception=>"Java::JavaLang::IllegalStateException", :message=>"Unable to configure plugins: (ConfigurationError) Something is wrong with your configuration.", :backtrace=>["org.logstash.config.ir.CompiledPipeline.<init>(CompiledPipeline.java:100)", "org.logstash.execution.JavaBasePipelineExt.initialize(JavaBasePipelineExt.java:60)",......

我正在使用下面提到的输入配置

    id => "pipeline_syslog_generic_input_udp"
    port => 5514
    codec => multiline {
    pattern => "^Event ID"
    what => "next" } // Also tried changing this to previous
    add_field => {
      "type" => "generic"
      "ingest_port" => "udp/5514"
    }

如果我做错了什么或者是否有更好的方法来解决这个问题，请告诉我。

标签： logstashelastic-stackelk

解决方案

推荐阅读