Logstash几个小时之后，停止随机

Question

我得到的随机错误，当我运行logstash：

16：30：26.240 [[主要]> worker0] ERROR logstash.pipeline - 异常在 pipelineworker，所述管道停止处理新事件，请 检查您的过滤器配置并重新启动Logstash。 { “异常”=>＃， “回溯”=> [ “组织/ jruby的/ RubyString.java：3101：在gsub'", "org/jruby/RubyString.java:3069:in GSUB”“， ”/usr/share/logstash/vendor/bundle/jruby/1.9/ gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb：317：in gsub_dynamic_fields'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:308:in gsub'“，”org/jruby/RubyArray.java：1613：in each'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:290:in gsub'“， ” /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:207:in filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in do_filter'“， ”/ usr /share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in multi_filter'", "org/jruby/RubyArray.java:1613:in each'“， ”/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb ：161：在 （eval）：4135：initialize'", "org/jruby/RubyArray.java:1613:in each'“，”（eval）：4131：in initialize'", "org/jruby/RubyProc.java:281:in call'“，”（eval）：997： filter_func'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:295:in filter_batch'“，”org/jruby /RubyProc.java:281:in call'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:192:in each'“，”org/jruby/RubyHash.java：1342：in each'", "/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:191:in each'“， ”/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb 294：在 filter_batch'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:282:in worker_loop'”， “/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:258:in start_workers'"]} 16:30:26.542 [LogStash::Runner] FATAL logstash.runner - An unexpected error occurred! {:error=>#<InterruptedRegexpError: Regexp Interrupted>, :backtrace=>["org/jruby/RubyString.java:3101:in GSUB'”， “组织/ JRuby中/ RubyString.java： 3069：在gsub'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:317:in gsub_dynamic_fields'“， ”/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb： 308： gsub'", "org/jruby/RubyArray.java:1613:in each'“， ”/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:290：在 gsub'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-mutate-3.1.3/lib/logstash/filters/mutate.rb:207:in 滤波器”'， “/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:145:in do_filter'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:164:in multi_filter'”，“组织/ jruby的/ RubyArray.java：1613：在each'", "/usr/share/logstash/logstash-core/lib/logstash/filters/base.rb:161:in multi_filter'”， “/usr/share/logstash/logstash-core/lib/logstash/filter_delegator.rb:41:in multi_filter'", "(eval):4135:in初始化'”， “组织/ JRuby中/ RubyArray.java：1613：在each'", "(eval):4131:in 初始化'“，”org/jruby/RubyProc.java：281：在call'", "(eval):997:in filter_func'“， ”/ usr/share/logstash/logstash-core/lib/logstash/p ipeline.rb：295：在 filter_batch'", "org/jruby/RubyProc.java:281:in呼叫”'， “/usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:192:in each'", "org/jruby/RubyHash.java:1342:in每个”“， ”的/ usr/share/logstash/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb：191： each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:294:in filter_batch'“， ”/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:282：在 worker_loop'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:258:in start_workers'“]}

我logstash配置文件是：

input { 
    file { 
     type => "SystemError" 
     path => "/app/systemerr/**/*" 
     start_position => "beginning" 


     codec => multiline { 
      pattern => "^\s" 
      what => "previous" 
     }  
    } 

    file { 
     type => "SystemOut" 
     path => "/app/systemout/**/*" 
      start_position => "beginning" 


     codec => multiline { 
      pattern => "^\[" 
      negate => true 
      what => "previous" 
     } 
    } 

    file { 
      type => "Errorlog" 
     path => "/app/error/**/*" 
      start_position => "beginning" 


     codec => multiline { 
      pattern => "^FATAL" 
      negate => true 
      what => "previous" 
     } 
    } 

    file { 
      type => "Messagelog" 
     path => "/app/message/**/*" 
      start_position => "beginning" 


     codec => multiline { 
      pattern => "^ERROR" 
      negate => true 
      what => "previous" 
     }  
    } 
} 

filter { 
    if [type] == "SystemError" { 
     grok { 
      match => { "message" => "\[%{DATA:timestamp}] %{BASE16NUM:threadID} (?<shortname>\b[A-Za-z0-9\$]{2,}\b)%{SPACE}%{WORD:loglevel}%{SPACE} %{GREEDYDATA:message}" } 
      overwrite => [ "message" ] 
     } 

     mutate { 
      gsub => ["timestamp", " GMT\+05\:30", ""] 
     } 

     date { 
      match => ["timestamp", "M/dd/yy HH:mm:ss:SSS"] 
     } 

     if ([message] =~ "^\tat") { 
       drop {} 
     } 

     if ([path] =~ "113") { 
      mutate { 
        add_field => { "server" => "113" } 
      } 
     } else { 
      mutate { 
        add_field => { "server" => "117" } 
      } 
     } 

    } 

    if [type] == "SystemOut" { 
     grok { 
      match => { "message" => "\[%{DATA:timestamp}] %{BASE16NUM:threadID} (?<shortname>\b[A-Za-z0-9\$]{2,}\b)%{SPACE}%{WORD:loglevel}%{SPACE} %{GREEDYDATA:message}" } 
      overwrite => [ "message" ] 
     } 

     mutate { 
      gsub => ["timestamp", " GMT\+05\:30", ""] 
     } 

     date { 
      match => ["timestamp", "M/dd/yy HH:mm:ss:SSS"] 
     } 

     if ([path] =~ "113") { 
      mutate { 
        add_field => { "server" => "113" } 
      } 
     } else { 
      mutate { 
        add_field => { "server" => "117" } 
      } 
     }  
    } 

    if [type] == "Errorlog" { 
     grok { 
      match => { "message" => "%{LOGLEVEL:loglevel} \| %{TIMESTAMP_ISO8601:timestamp} \| %{DATA:string} \: %{DATA:WebContainer} \| %{DATA:code} \| %{DATA:country} \| %{DATA:user} \| %{GREEDYDATA:message}" } 
      overwrite => [ "message" ] 
     } 

     date { 
      match => ["timestamp", "yyyy-M-dd HH:mm:ss,SSS"] 
     } 

     mutate { remove_field => [ "string" ] } 

     if ([path] =~ "113") { 
      mutate { 
        add_field => { "server" => "113" } 
      } 
     } else { 
      mutate { 
        add_field => { "server" => "117" } 
      } 
     }  
    } 

    if [type] == "Messagelog" { 
     grok { 
      match => { "message" => "%{LOGLEVEL:loglevel} \| %{TIMESTAMP_ISO8601:timestamp} \| %{DATA:string} \: %{DATA:WebContainer} \| %{DATA:code} \| %{DATA:country} \| %{DATA:user} \| %{GREEDYDATA:message}" } 
      overwrite => [ "message" ] 
     } 

     date { 
      match => ["timestamp", "yyyy-M-dd HH:mm:ss,SSS"] 
     } 

     mutate { 
      remove_field => [ "string" ] 
     } 

     if ([path] =~ "113") { 
      mutate { 
        add_field => { "server" => "113" } 
      } 
     } else { 
      mutate { 
        add_field => { "server" => "117" } 
      } 
     }  

    } 

} 

配置文件有什么问题吗？请帮忙。

Answer 1

您很可能会收到_grokparsefailure，因此未设置timestamp字段。您可以环绕发生变异/日期与if块这样的：

if "_grokparsefailure" not in [tags] { 
    mutate { 
     gsub => ["timestamp", " GMT\+05\:30", ""] 
    } 

    date { 
     match => ["timestamp", "M/dd/yy HH:mm:ss:SSS"] 
    } 
} 

您可能还需要增加一个else { drop {} }，但是你应该弄清楚什么是不是第一个匹配。