file - Logstash 不读取文件输入

Question

我在使用 Logstash 时遇到了一个奇怪的问题。我正在提供一个日志文件作为 logstash 的输入。配置如下:

input {
  file {
    type => "apache-access"
    path => ["C:\Users\spanguluri\Downloads\logstash\bin\test.log"]
  }
}
output {
  elasticsearch {
    protocol => "http"
    host => "10.35.143.93"
    port => "9200"
    index => "latestindex"
  }
}

我已经在运行 elasticsearch 服务器并验证是否正在接收数据 curl 查询。问题是，当输入是一个文件 时，没有接收到任何数据。但是，如果我按如下方式将输入更改为 stdin { }，它会顺利发送所有输入数据:

input {
  stdin{ }
}
output {
  elasticsearch {
    protocol => "http"
    host => "10.35.143.93"
    port => "9200"
    index => "latestindex"
  }
}

我不知道哪里出错了。有人可以看看这个吗？

Answer 1

您应该在您的文件部分下设置 start_position:

start_position => "beginning"

它默认结束，因此不会读取文件中的任何现有行，只会读取新添加的行:

start_position

Value can be any of: "beginning", "end"
Default value is "end"

Choose where Logstash starts initially reading files: at the beginning or at the end. The default behavior treats files like live streams and thus starts at the end. If you have old data you want to import, set this to ‘beginning’

This option only modifies “first contact” situations where a file is new and not seen before. If a file has already been seen before, this option has no effect.