logstash-启动

本次使用的是logstash-6.8.1版本

logstash依赖于JDK，所以需要先安装JAVA_HOME环境变量

安装路径需要注意，不能含有冒号（:）

官网文档：https://www.elastic.co/guide/en/logstash/6.8/first-event.html
windows启动：https://www.elastic.co/guide/en/logstash/6.8/running-logstash-windows.html
windows下安装：
直接解压，就是安装成功

关于启动logstash:
logstash启动需要有配置文件，在此安装目录中config中已经有了配置，logstash-sample.conf
配置如下：

# Sample Logstash configuration for creating a simple
# Beats -> Logstash -> Elasticsearch pipeline.

input {
  beats {
    port => 5044
  }
}

output {
  elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    #user => "elastic"
    #password => "changeme"
  }
}

logstash默认是安装beats的（端口5044），output中可以看出需要启动elasticsearch（可以设置用户名密码）

因此启动测试配置试一下：logstash -f …/config/logstash-sample.conf --config.test_and_exit
结果：
在这里插入图片描述
启动命令：logstash -f …/config/logstash-sample.conf
logstash日志窗口：
在这里插入图片描述
elasticsearch 日志窗口：
在这里插入图片描述
访问地址：http://localhost:9600/
打印如下：
{“host”:“DESKTOP-wl”,“version”:“6.8.1”,“http_address”:“127.0.0.1:9600”,“id”:“430d33d7-99cd-4a36-b403-e0efadb30615”,“name”:“DESKTOP-wl”,“build_date”:“2019-06-18T14:11:07+00:00”,“build_sha”:“e99c3a5386ec3b64789dc003fc99e0a86ede0f0f”,“build_snapshot”:false}
说明启动成功

logstash -f ../config/logstash-sample.conf --config.reload.automatic

该–config.reload.automatic选项启用自动配置重新加载，因此您不必在每次修改配置文件时停止并重新启动Logstash。

报错：

  • 1.无法加载到主类*****animal-sniffer-annotations-1.14.jar
    解决办法，就是将windows下的安装包复制到没有空格的安装路径下，logstash会对有空格的路径报错
  • 2.An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception
[io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
io.netty.handler.codec.DecoderException: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:472) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:405) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInputClosed(ByteToMessageDecoder.java:372) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.channelInactive(ByteToMessageDecoder.java:355) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelInactive(AbstractChannelHandlerContext.java:245) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext.access$300(AbstractChannelHandlerContext.java:38) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.channel.AbstractChannelHandlerContext$4.run(AbstractChannelHandlerContext.java:236) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.DefaultEventExecutor.run(DefaultEventExecutor.java:66) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:897) [netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.30.Final.jar:4.1.30.Final]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_192]
Caused by: org.logstash.beats.BeatsParser$InvalidFrameProtocolException: Invalid Frame Type, received: 84
        at org.logstash.beats.BeatsParser.decode(BeatsParser.java:92) ~[logstash-input-beats-5.1.8.jar:?]
        at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:502) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:441) ~[netty-all-4.1.30.Final.jar:4.1.30.Final]
        ... 10 more