1. logstash 无法连接 kafka
logstash 版本: logstash-1.5.4-1.noarch.rpm
logstash.log 错误信息:
{:timestamp=>"2015-11-16T18:41:00.365000+0800", :message=>"The error reported is: \n uninitialized constant Concurrent::Delay::Executor"}
解决方法:
降级版本就可以: logstash-1.5.2-1.noarch.rpm
2. 降级后发现 grok 匹配完全错误了
把之前 logstash-1.5.4-1.noarch.rpm grok patterns 进行替换就可以
grok 语法匹配必须要根据不同版本的 patterns 使用不同语法
默认位置
rpm -ql logstash | grep grok | grep patterns
简单升级方法
/opt/logstash/bin/plugin update grok
也可以从其他 rpm 包中直接提取文件, 如
/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/grok-patterns
3. 输出详细日志方法
[root@hh-yun-pinyun-129181 ~]# grep LS_OPTS /etc/init.d/logstash LS_OPTS="--verbose"
4 验证配置文件是否正确方法
/opt/logstash/bin/logstash --configtest -f /etc/logstash/conf.d/hh-yun.conf Configuration OK
5. 常见日志错误如下
tail -f /var/log/logstash-forwarder/logstash-forwarder.err 2015/12/07 17:43:30.961175 Failed to tls handshake with 10.199.129.61 x509: cannot validate certificate for 10.199.129.61 because it doesn't contain any IP SANs
解决:
vim /etc/pki/tls/openssl.cnf [ v3_ca ] subjectAltName=IP:10.199.129.61 <-添加对应信息 重新创建密钥对 openssl req -subj '/CN=hh-yun-haproxy-129061.vclound.com/' -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout /etc/pki/tls/private/logstash-forwarder.key -out /etc/pki/tls/certs/logstash-forwarder.crt 重启服务 [root@hh-yun-haproxy-129061 ~]# service logstash-forwarder restart logstash-forwarder stopped. logstash-forwarder started
6. 增大事件传输数量
vim /etc/init.d/logstash-forwarder args=-config\ /etc/logstash-forwarder.conf\ -spool-size\ 4096\ -harvest-buffer-size\ 32768
