Logstash 期望其中之一

Question

有人可以帮我吗，如何解决这个问题，下面的代码在logstash configmap中使用？

input {
      gelf {
        host => "0.0.0.0"
        port => 12201
        rb => |
          def self.coerce_timestamp(timestamp)
            timestamp.is_a?(BigDecimal) ? LogStash::Timestamp.at(timestamp.to_i, timestamp.frac * 1000000)
            : LogStash::Timestamp.at(timestamp)
        end
      }
      http {
        ssl => false
        host => "0.0.0.0"
        port => 8080
      }
      tcp {
        mode => "server"
        host => "0.0.0.0"
        port => 5010
      }
      udp {
        host => "0.0.0.0"
        port => 5000
      }
    }
    filter {
      if [parentId] =~ "0" {
        mutate {
          replace => {
            "parentId" => "0"
          }
        }
      }
      if [parentId] =~ /^0/ {
        mutate {
          replace => {
            "parentId" => "0"
          }
        }
      }
      if [parentId] == 0 {
        mutate {
          replace => {
            "parentId" => "0"
          }
        }
      }
    }
    output {
      elasticsearch {
        hosts => "elastic-elasticsearch.elk.svc.cluster.local:9200"
        user => "elastic"
        password => "Avitech"
        # manage_template => false
        index => "logstash-%{+YYYY.MM.dd}"
      }
      stdout{}
    }

错误信息：

 [2024-04-30T14:02:37,082][ERROR][logstash.agent           ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message ││ =>"Expected one of [ \\t\\r\\n], \"#\", [A-Za-z0-9_-], '\"', \"'\", [A-Za-z_], \"-\", [0-9], \"[\", \"{\" at line 5, column 11 (byte 68) after input {\n  gelf {\n    host => \"0.0.0.0\"\n    port => ││  12201\n    rb => ", :backtrace=>["/opt/bitnami/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:189:in `initialize'", "o ││ rg/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/opt/bitnami/logstash/logstash-core/lib/logstash/java_pipeline.rb:48:in `initialize'", "/opt/bitnami/logstash/logstash-core/lib/l ││ ogstash/pipeline_action/create.rb:52:in `execute'", "/opt/bitnami/logstash/logstash-core/lib/logstash/agent.rb:388:in `block in converge_state'"]}                                                     ││ [2024-04-30T14:02:37,263][INFO ][logstash.runner          ] Logstash shut down.                                                                                                                        ││ [2024-04-30T14:02:37,286][FATAL][org.logstash.Logstash    ] Logstash stopped processing because of an error: (SystemExit) exit 

logstash 给我这个错误，我不知道，出了什么问题，logstash 作为 pod 在 kubernetes 中运行

我尝试了一切，但我不知道哪里可能有问题:(

有什么想法吗？？

Answer 1

我认为问题出在 gelf 输入插件中的 rb 部分。它不直接支持 ruby 代码。

我建议将 ruby 代码移到logstash 之外并从logstash 本身引用该文件。

一个例子是：

# custom.rb
def coerce_timestamp(timestamp)
  timestamp.is_a?(BigDecimal) ? LogStash::Timestamp.at(timestamp.to_i, timestamp.frac * 1000000) : LogStash::Timestamp.at(timestamp)
end

gelf {
    host => "0.0.0.0"
    port => 12201
    rb => "/path/to/custom.rb" 
    rb_func => "coerce_timestamp"
  }