配置與輸出文件和編解碼器不解析logstash

Question

我正在嘗試一個「簡單」logstash配置，並希望輸出到一個文件進行檢查。所以，我把從CONF和https://www.elastic.co/guide/en/logstash/current/plugins-outputs-file.html把它放在我的conf：

input {                                                         
    file { 
    exclude => ['*.gz'] 
    path => ['/var/log/*.log'] 
    type => 'system logs' 
    } 
    syslog { 
    port => 5000 
    } 
} 

output { 
    elasticsearch { 
    hosts => ['elasticsearch'] 
    } 

    file { 
    path => "/config/logstash_out.log" 
    codec => { 
     line { 
     format => "message: %{message}" 
     } 
    } 
    } 

    stdout {} 
} 

但是當我啓動它（sudo docker run -it --rm --name logstash -p 514:5000 --link elasticsearch:elasticsearch -v "$PWD":/config logstash logstash -f /config/logstash.conf），我得從logstash投訴：

fetched an invalid config 
{:config=>"input { 
    file { 
    exclude => ['*.gz'] 
    path => ['/var/log/*.log'] 
    type => 'system logs' 
    } 
    syslog { 
    port => 5000 
    } 
} 
output { 
    elasticsearch { 
    hosts => ['elasticsearch'] 
    } 

    file { 
    path => \"/config/logstash_out.log\" 
    codec => { 
     line { 
     format => \"message: %{message}\" 
     } 
    } 
    } 

    stdout {} 
}" 
, :reason=>"Expected one of #, => at line 20, column 13 (byte 507) 
after output { elasticsearch {\n hosts => ['elasticsearch']\n } 
\n\n file {\n path => \"/config/logstash_out.log\"\n  
codec => { \n  line ", :level=>:error} 

（我重新格式化了一下，所以它更具可讀性）

任何想法爲什麼？ I'seen logstash output to file and ignores codec但建議的解決方案標記爲DEPRECATED，所以我想避免

謝謝！

Answer 1

與教程類似，您的格式不正確。 這是the pull request。

這不是

codec => { 
     line { 
     format => \"message: %{message}\" 
     } 
    } 

但

codec => 
     line { 
     format => "message: %{message}" 
     } 

你並不需要添加一行左右括號quirly。

這是你的配置正確。

input {                                                         
    file { 
    exclude => ['*.gz'] 
    path => ['/var/log/*.log'] 
    type => 'system logs' 
    } 
    syslog { 
    port => 5000 
    } 
} 

output { 
    elasticsearch { 
    hosts => ['elasticsearch'] 
    } 

    file { 
    path => "/config/logstash_out.log" 
    codec => 
     line { 
     format => "message: %{message}" 
     } 

    } 

    stdout {} 
}