无法通过Logstash从文件导入json数据

Question

我试图从我的日志文件mylogs.log导入JSON数据。以下是我的logstash配置文件。

input { 
    stdin { } 

    file { 
     codec => "json" 
     path => "/logs/mylogs.log" 
     start_position => "beginning" 
     sincedb_path => "/dev/null" 
    } 
} 

filter{ 
    json{ 
     source => "message" 
    } 
} 

output { 
    elasticsearch { 
     hosts => ["localhost:9200"] 
     index => "jsonlog" 
    } 

    stdout { codec => rubydebug } 

    file { 
     path => "/logs/out.log" 
    } 
} 

执行此配置文件，如果我通过它得到任何JSON数据解析&发送到Elasticsearch实例后。我可以从Elasticsearch实例中看到。但是，日志文件中存在的任何数据都不会被logstash导入。

此外，当我手动添加JSON数据，由Logstash &解析发送Elasticsearch实例...这些数据也没有gettign记录在我的OUTPUT文件中。

不知道是什么问题。

我正在使用的示例JSON数据。

{ "logger":"com.myApp.ClassName", "timestamp":"1456976539634", "level":"ERROR", "thread":"pool-3-thread-19", "message":"Danger. There was an error", "throwable":"java.Exception" } 
{ "logger":"com.myApp.ClassName", "timestamp":"1456976539649", "level":"ERROR", "thread":"pool-3-thread-16", "message":"I cannot go on", "throwable":"java.Exception" } 

Answer 1

好了，在使用Lagstash配置文件中的以下修改文件路径插件之后，它现在正在工作。

input { 
    stdin { } 

    file { 
     codec => "json" 
     path => "/home/suresh/Desktop/tools/logstash-5.1.1/logs/mylogs.log" 
     start_position => "beginning" 
     sincedb_path => "/dev/null" 
    } 
} 

filter{ 
    json{ 
     source => "message" 
    } 
} 

output { 
    elasticsearch { 
     hosts => ["localhost:9200"] 
     index => "jsonlog2" 
    } 

    stdout { codec => rubydebug } 

    file { 
     path => "/home/suresh/Desktop/tools/logstash-5.1.1/logs/out.log" 
    } 
} 

但是，我越来越"tags" => [ [0] "_jsonparsefailure" ]

响应的错误，从控制台 -

{ 
      "path" => "/home/suresh/Desktop/tools/logstash-5.1.1/logs/mylogs.log", 
    "@timestamp" => 2016-12-27T09:56:08.854Z, 
     "level" => "ERROR", 
     "logger" => "com.myApp.ClassName", 
    "throwable" => "java.Exception", 
     "@version" => "1", 
      "host" => "BLR-SOFT-245", 
     "thread" => "pool-3-thread-19", 
     "message" => "Danger. There was an error", 
    "timestamp" => "1456976539634", 
      "tags" => [ 
     [0] "_jsonparsefailure" 
    ] 
}