开发者社区> 问答> 正文

logstash监控tomcat时添加的条件语句启动报错?报错

配置信息如下,总是报错,感觉没什么错的,跟官网提供的没区别:


filter {
        if [type] == "tomcat1-log" {
                multiline {
                        patterns_dir => "/local/logstash/patterns"
                        pattern => "(^%{TOMCAT_DATESTAMP})|(^%{CATALINA_DATESTAMP})"
                        negate => true
                        what => "previous"
                }

                grok {
                        patterns_dir => "/local/logstash/patterns"
                        match => [ "message", "%{TOMCATLOG}", "message", "%{CATALINALOG}" ]
                }

                date {
                        match => [ "timestamp", "yyyy-MM-dd HH🇲🇲ss,SSS Z", "MMM dd, yyyy HH🇲🇲ss a" ]
                }
        }
}



报错信息:

[local@localhost logstash]$ Error at line 19, column 5: "[type] == \"tomcat1-log\" {\n                multiline {\n                        patterns_dir => \"/local/logstash/patterns\"\n\t\t\tpattern => \"(^%{TOMCAT_DATESTAMP})|(^%{CATALINA_DATESTAMP})\"\n      \t\t\tnegate => true\n      \t\t\twhat => \"previous\"\n\t\t}\n\n\t\tgrok {\n      \t\t\tpatterns_dir => \"/local/logstash/patterns\"\n      \t\t\tmatch => [ \"message\", \"%{TOMCATLOG}\", \"message\", \"%{CATALINALOG}\" ]\n    \t\t}\n\n    \t\tdate {\n      \t\t\tmatch => [ \"timestamp\", \"yyyy-MM-dd HH🇲🇲ss,SSS Z\", \"MMM dd, yyyy HH🇲🇲ss a\" ]\n    \t\t}\n\t}\n}\noutput {\nstdout { debug => true debug_format => \"json\"}\nelasticsearch {\n#host => \"127.0.0.1\"\nembedded => true\n}\n}\n\n"
Error at line 19, column 5: "[type] == \"tomcat1-log\" {\n                multiline {\n                        patterns_dir => \"/local/logstash/patterns\"\n\t\t\tpattern => \"(^%{TOMCAT_DATESTAMP})|(^%{CATALINA_DATESTAMP})\"\n      \t\t\tnegate => true\n      \t\t\twhat => \"previous\"\n\t\t}\n\n\t\tgrok {\n      \t\t\tpatterns_dir => \"/local/logstash/patterns\"\n      \t\t\tmatch => [ \"message\", \"%{TOMCATLOG}\", \"message\", \"%{CATALINALOG}\" ]\n    \t\t}\n\n    \t\tdate {\n      \t\t\tmatch => [ \"timestamp\", \"yyyy-MM-dd HH🇲🇲ss,SSS Z\", \"MMM dd, yyyy HH🇲🇲ss a\" ]\n    \t\t}\n\t}\n}\noutput {\nstdout { debug => true debug_format => \"json\"}\nelasticsearch {\n#host => \"127.0.0.1\"\nembedded => true\n}\n}\n\n"
RuntimeError: Invalid Configuration. Check syntax of config file.
            parse at file:/local/logstash/logstash-1.1.0-monolithic.jar!/logstash/config/grammar.rb:552
            parse at file:/local/logstash/logstash-1.1.0-monolithic.jar!/logstash/config/file.rb:28
     parse_config at file:/local/logstash/logstash-1.1.0-monolithic.jar!/logstash/agent.rb:257
  run_with_config at file:/local/logstash/logstash-1.1.0-monolithic.jar!/logstash/agent.rb:341
  run_with_config at file:/local/logstash/logstash-1.1.0-monolithic.jar!/logstash/agent.rb:340
              run at file:/local/logstash/logstash-1.1.0-monolithic.jar!/logstash/agent.rb:304
Exception in thread "LogStash::Agent" org.jruby.exceptions.RaiseException: (SystemExit) Invalid Configuration. Check syntax of config file.
	at #<Class:0x2b6968b7>.method_missing(file:/local/logstash/logstash-1.1.0-monolithic.jar!/builtin/javasupport/java.rb:51)
	at LogStash::Program.exit(file:/local/logstash/logstash-1.1.0-monolithic.jar!/logstash/program.rb:9)
	at logstash.runner.main(logstash/runner.rb:46)
	at logstash.runner.(root)(logstash/runner.rb:108)




展开
收起
爱吃鱼的程序员 2020-06-14 22:45:20 522 0
1 条回答
写回答
取消 提交回答
  • https://developer.aliyun.com/profile/5yerqm5bn5yqg?spm=a2c6h.12873639.0.0.6eae304abcjaIB

    你用的是什么版本...?1.1.0jar另外检查一下的编码问题...你若是windows下编写,注意编码问题是在linux下,jar版本启动centos6.3你把negate去掉看。 又改了改,可以启动了,有没有现在在使用的配置我参考下,不胜感激

    你留个联系方式,QQ之类的。

    121272604

    2020-06-14 22:45:38
    赞同 展开评论 打赏
问答排行榜
最热
最新

相关电子书

更多
Apache Tomcat 的云原生演进 立即下载
《Nginx 代理系统常用手册》 立即下载
CentOS Nginx PHP JAVA多语言镜像使用手册 立即下载

相关实验场景

更多