elasticsearch 日志存储-管道已终止

我正在学习麋鹿的堆叠。现在，我在AWS实例上设置了Elasticsearch和Kibana。我正在通过我编写的Java控制台应用程序成功地将文档写入索引上的Elasticsearch索引。我可以在Kibana看到那些日志。现在，我想看到这些日志输入到另一台机器上的Logstash中

为了做到这一点，我安装了Logstash。我添加了以下配置：

logstash.conf

input { 
  elasticsearch {
    hosts => "https://<aws-instance>.us-east-1.aws.found.io:9243"
    user => "<myUsername>"
    password => "<myPassword>"
    index => "<myIndexName>"
    query => '{ "query": { "match": { "statuscode": 200 } }, "sort": [ "_doc" ] }'
  }
}
output {
  stdout { }
}

---

我不知道为什么它会关闭。

看起来logstash从错误的文件中读取管道配置。默认情况下，您应该将管道配置放在此目录

/etc/logstash/conf.d/

中。logstash从

conf.d

文件夹读取管道配置。@MichaelDz我在Windows上运行logstash，因此

/etc/

本机不可用。尽管如此，我仍然相信logstash使用的是正确的配置文件，因为否则，我不认为会显示

logstash.inputs.elasticsearch

DEBUG

消息。管道配置文件存储在哪里，如何启动logstash？我遵循了logstash设置说明。我的配置文件位于Logstash安装目录中。该目录有一个名为“bin”的目录，其中包含可执行文件。要运行Logstash，我在命令行中输入

bin\Logstash–f Logstash.conf

。改用绝对路径。并手动运行elasticsearch查询，查看它是否实际返回任何内容。

Sending Logstash logs to C:/Temporary/logs which is now configured via log4j2.properties
[...][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[...][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"6.4.2"}
[...][INFO ][logstash.pipeline        ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}
[...][INFO ][logstash.pipeline        ] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x13bbcec sleep>"}
[...][INFO ][logstash.agent           ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[...][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>9600}
[...][INFO ][logstash.pipeline        ] Pipeline has terminated {:pipeline_id=>"main", :thread=>"#<Thread:0x13bbcec run>"}

[...][DEBUG][logstash.inputs.elasticsearch] Closing {:plugin=>"LogStash::Inputs::Elasticsearch"}