Logstash只给了我两块木头

Question

使用里程碑2输入插件文件。这个插件应该是稳定的，但是如果你看到奇怪的行为，请让我们知道！有关插件的详细信息，请参阅http://logstash.net/docs/1.4.2/plugin-milestones{： level=

我的配置：

input {
file {
path => [ "e:\mycsvfile.csv" ]
start_position => "beginning"
}
}
filter {
csv {
columns => ["col1","col2"]
source => "csv_data"
separator => ","
}
}

output {
elasticsearch { 
host => localhost
port => 9200
index => test
index_type => test_type
protocol => http
}
stdout { 
codec => rubydebug
}
}

我的环境：Windows 8 logstash 1.4.2

问：以前有人经历过这种情况吗？日志存放在哪里？windows上是否存在已知的日志存储错误？根据我的经验，logstash什么也做不了。

我试过：

logstash.bat agent -f test.conf --verbose
←[33mUsing milestone 2 input plugin 'file'. This plugin should be stable, but if
you see strange behavior, please let us know! For more information on plugin mi
lestones, see http://logstash.net/docs/1.4.2/plugin-milestones {:level=>:warn}←[
0m
←[33mUsing milestone 2 filter plugin 'csv'. This plugin should be stable, but if
you see strange behavior, please let us know! For more information on plugin mi
lestones, see http://logstash.net/docs/1.4.2/plugin-milestones {:level=>:warn}←[
0m
←[32mRegistering file input {:path=>["e:/temp.csv"], :level=>:info}←[0m
←[32mNo sincedb_path set, generating one based on the file path {:sincedb_path=>
"C:\Users\gemini/.sincedb_d8e46c18292a898ea0b5b1cd94987f21", :path=>["e:/tem
p.csv"], :level=>:info}←[0m
←[32mPipeline started {:level=>:info}←[0m
←[32mNew Elasticsearch output {:cluster=>nil, :host=>"localhost", :port=>9200, :
embedded=>false, :protocol=>"http", :level=>:info}←[0m
←[32mAutomatic template management enabled {:manage_template=>"true", :level=>:i
nfo}←[0m
←[32mUsing mapping template {:template=>"{ \"template\" : \"logstash-\", \"se
ttings\" : { \"index.refresh_interval\" : \"5s\" }, \"mappings\" : { \"_
default_\" : { \"_all\" : {\"enabled\" : true}, \"dynamic_templates\
" : [ { \"string_fields\" : { \"match\" : \"\", \"m
atch_mapping_type\" : \"string\", \"mapping\" : { \"type\"
: \"string\", \"index\" : \"analyzed\", \"omit_norms\" : true, \"
fields\" : { \"raw\" : {\"type\": \"string\", \"index\" : \"not_
analyzed\", \"ignore_above\" : 256} } } }
} ], \"properties\" : { \"@version\": { \"type\": \"string\", \"in
dex\": \"not_analyzed\" }, \"geoip\" : { \"type\" : \"object\
", \"dynamic\": true, \"path\": \"full\", \"
properties\" : { \"location\" : { \"type\" : \"geo_point\" }
} } } } }}", :level=>:info}←[0m

这种情况会持续一段时间，elasticsearch中不会创建新索引。

Answer 1

使用CSV作为输入数据时，我必须添加：

sincedb_path=

示例：

input {
file {
    path => [ "C:/csvfilename.txt"]
    start_position => "beginning"
    sincedb_path => "NIL"
}

}

它适用于logstash版本1.4.2

Answer 2

我不得不补充：

sincedb_path => "NIL"

它成功了。

http://logstash.net/docs/1.1.0/inputs/file#setting_sincedb_path

因为CEDB_路径值类型为字符串，所以此设置没有默认值。在何处写入自数据库（跟踪受监视日志文件的当前位置）。默认为环境变量“$SINCEDB_PATH”或“$HOME/.SINCEDB”的值。

在我的C:\users{user}中生成了几个sincedb文件。