elasticsearch OSX:logstash工作一段时间，然后在“logstash shutdown completed”消息中停止((

在我升级到logstash 1.5.0之后，我发现这个程序的行为很奇怪。 每当我使用下一个命令运行它时：

 $ logstash agent -f /usr/local/etc/logstash/conf.d/logstash.conf

它工作了一段时间，然后停止说Logstash shutdown completed。 例如：

即使在完全重新安装后：

$ brew rm logstash
$ brew install logstash

我也有同样的问题

这是my/usr/local/etc/logstash/conf.d/logstash.conf：

---

为什么？我做错了什么？

没关系-我已经更新了logstash，现在它可以正常工作了

$ brew rm logstash
$ brew install logstash

input {
  file {
    path => ["/var/log/suricata/eve.json"]
    sincedb_path => ["/var/lib/logstash/"]
    codec =>   json
    type => "SuricataIDPS"
    start_position => "beginning"
  }

}

filter {
  if [type] == "SuricataIDPS" {
    date {
      match => [ "timestamp", "ISO8601" ]
    }
    ruby {
      code => "if event['event_type'] == 'fileinfo'; event['fileinfo']['type']=event['fileinfo']['magic'].to_s.split(',')[0]; end;"
    }
  }

  if [src_ip]  {
    geoip {
      source => "src_ip"
      target => "geoip"
      #database => "/usr/local/opt/logstash/libexec/vendor/geoip/GeoLiteCity.dat"
      add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
      add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
    }
    mutate {
      convert => [ "[geoip][coordinates]", "float" ]
    }
    if ![geoip.ip] {
      if [dest_ip]  {
        geoip {
          source => "dest_ip"
          target => "geoip"
          #database => "/usr/local/opt/logstash/libexec/vendor/geoip/GeoLiteCity.dat"
          add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
          add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}"  ]
        }
        mutate {
          convert => [ "[geoip][coordinates]", "float" ]
        }
      }
    }
  }
}

output {
  elasticsearch {
    host => localhost
    protocol => http
  }
  stdout {
      codec => rubydebug
   }
}