elasticsearch 我想通过logstash中的时间值设置索引名,elasticsearch,logstash,elasticsearch,Logstash" /> elasticsearch 我想通过logstash中的时间值设置索引名,elasticsearch,logstash,elasticsearch,Logstash" />

elasticsearch 我想通过logstash中的时间值设置索引名

elasticsearch 我想通过logstash中的时间值设置索引名,elasticsearch,logstash,elasticsearch,Logstash,我的配置 input { http { host => "0.0.0.0" port => "18080" codec => es_bulk { } type => "http" } heartbeat { interval => 10 type => "heartbeat" } } output { if [type] == "heartbeat" { elasticsear

我的配置

input {
 http {
    host => "0.0.0.0"
    port => "18080"
    codec => es_bulk {
    }
    type => "http"
  }
  heartbeat {
    interval => 10
    type => "heartbeat"
  }
}

output {
  if [type] == "heartbeat" {
    elasticsearch {
      hosts => "1.2.3.4:9200"
      index  => "logstash-%{+YYYY.MM.dd}" <-- error
      index  => "logstash" <-- not error
    }
  } else {
    elasticsearch {
      hosts => "1.2.3.4:9200"
      index => "%{[@metadata][_index]}"
      document_type => "%{[@metadata][_type]}"
      template_name => "%{[@metadata][_template]}"
    }
  }

  stdout {
    codec => rubydebug {
      metadata => true
    }
  }
}
输入{
http{
主机=>“0.0.0.0”
端口=>“18080”
编解码器=>es_批量{
}
类型=>“http”
}
心跳{
间隔=>10
类型=>“心跳”
}
}
输出{
如果[type]=“心跳”{
弹性搜索{
hosts=>“1.2.3.4:9200”
索引=>“logstash-%{+YYYY.MM.dd}”“logstash”“1.2.3.4:9200”
index=>“%{[@metadata][\u index]}”
文档类型=>“%{[@metadata][\u类型]}”
template_name=>“%{[@metadata][\u template]}”
}
}
stdout{
编解码器=>rubydebug{
元数据=>true
}
}
}
同时,我想接收“输入http”和“心跳”。 以时间形式插入索引名时出错

怎么了

错误日志

[2017-09-06T18:49:14,759][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"Malformed escape pair at index 11: /_template/%{[@metadata][_template]}", :class=>"Java::JavaNet::URISyntaxException", :backtrace=>["java.net.URI$Parser.fail(java/net/URI.java:2848)", "java.net.URI$Parser.scanEscape(java/net/URI.java:2978)", "java.net.URI$Parser.scan(java/net/URI.java:3001)", "java.net.URI$Parser.checkChars(java/net/URI.java:3019)", "java.net.URI$Parser.parseHierarchical(java/net/URI.java:3105)", "java.net.URI$Parser.parse(java/net/URI.java:3063)", "java.net.URI.<init>(java/net/URI.java:588)", "java.lang.reflect.Constructor.newInstance(java/lang/reflect/Constructor.java:423)", "RUBY.format_url(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:96)", "RUBY.perform_request(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:67)", "RUBY.perform_request_to_url(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:269)", "RUBY.perform_request(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:257)", "RUBY.with_connection(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:347)", "RUBY.perform_request(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:256)", "RUBY.head(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:264)", "RUBY.template_exists?(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client.rb:318)", "RUBY.template_install(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client.rb:78)", "RUBY.install(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/template_manager.rb:29)", "RUBY.install_template(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/template_manager.rb:9)", "RUBY.install_template(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/common.rb:62)", "RUBY.register(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/common.rb:29)", "RUBY.register(/home1/user/apps/logstash/logstash-core/lib/logstash/output_delegator_strategies/shared.rb:9)", "RUBY.register(/home1/user/apps/logstash/logstash-core/lib/logstash/output_delegator.rb:41)", "RUBY.register_plugin(/home1/user/apps/logstash/logstash-core/lib/logstash/pipeline.rb:268)", "RUBY.register_plugins(/home1/user/apps/logstash/logstash-core/lib/logstash/pipeline.rb:279)", "org.jruby.RubyArray.each(org/jruby/RubyArray.java:1613)", "RUBY.register_plugins(/home1/user/apps/logstash/logstash-core/lib/logstash/pipeline.rb:279)", "RUBY.start_workers(/home1/user/apps/logstash/logstash-core/lib/logstash/pipeline.rb:288)", "RUBY.run(/home1/user/apps/logstash/logstash-core/lib/logstash/pipeline.rb:214)", "RUBY.start_pipeline(/home1/user/apps/logstash/logstash-core/lib/logstash/agent.rb:398)", "java.lang.Thread.run(java/lang/Thread.java:745)"]}
[2017-09-06T18:49:14,837][FATAL][logstash.runner          ] An unexpected error occurred! {:error=>#<LogStash::Error: timestamp field is missing>, :backtrace=>["org/logstash/ext/JrubyEventExtLibrary.java:202:in `sprintf'", "/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/common.rb:173:in `event_action_params'", "/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/common.rb:48:in `event_action_tuple'", "/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/common.rb:42:in `multi_receive'", "org/jruby/RubyArray.java:2414:in `map'", "/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/common.rb:42:in `multi_receive'", "/home1/user/apps/logstash/logstash-core/lib/logstash/output_delegator_strategies/shared.rb:13:in `multi_receive'", "/home1/user/apps/logstash/logstash-core/lib/logstash/output_delegator.rb:47:in `multi_receive'", "/home1/user/apps/logstash/logstash-core/lib/logstash/pipeline.rb:407:in `output_batch'", "org/jruby/RubyHash.java:1342:in `each'", "/home1/user/apps/logstash/logstash-core/lib/logstash/pipeline.rb:406:in `output_batch'", "/home1/user/apps/logstash/logstash-core/lib/logstash/pipeline.rb:352:in `worker_loop'", "/home1/user/apps/logstash/logstash-core/lib/logstash/pipeline.rb:317:in `start_workers'"]}
[2017-09-06T18:49:14759][ERROR][logstash.outputs.elasticsearch]无法安装模板。{:message=>“索引11处格式错误的转义对:/\u-template/%{[@metadata][\u-template]}”,:class=>“Java::JavaNet::urisyntaxeption”,:backtrace=>[“Java.net.URI$Parser.fail(Java/net/URI.Java:2848)”,“Java.net.URI$Parser.scansece(Java/net/URI.Java:2978)”,“Java.net.URI$Parser.scan(Java/net/URI.Java:3001)”,“Java.net.URI$Parser.checkChars”(java/net/URI.java:3019)”,“java.net.URI$Parser.parseHierarchical(java/net/URI.java:3105)”,“java.net.URI$Parser.parse(java/net/URI.java:3063)”,“java.net.URI.(java/net/URI.java:588)”,“java.lang.reflect.Constructor.newInstance(java/lang/reflect/Constructor.java:423)”,“RUBY.format\uURL”(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:96)”,“RUBY.perform_请求(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:67)”,“RUBY.perform_请求到_url”(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_-client/pool.rb:269)”,“RUBY.perform请求(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.5-java/lib/logstash/outputs/elasticsearch/http_-client/pool.rb:257)”,“RUBY.with_连接(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:347)”,“RUBY.perform_请求”(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:256)”,“RUBY.head(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:264)”,”RUBY.template_存在?(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_client.rb:318)”,“RUBY.template_安装(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/http_-client.rb:78)“,”RUBY.install(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/template_-manager.rb:29)”,”RUBY.install_-template(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/template):9)“,”RUBY.install_模板(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/common.rb:62)”,“RUBY.register(/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/common.rb:29)”,”RUBY.register(/home1/user/apps/logstash/logstash core/lib/logstash/output_delegator_strategies/shared.rb:9)”、“RUBY.register(/home1/user/apps/logstash/logstash-core/lib/logstash/output_delegator.rb:41)”、“RUBY.register_插件(/home1/user/apps/logstash/logstash-core/lib/logstash/logstash/lib/logstash/logstash/logstash/logstash-core/pipeline.rb:268)”、(/home1/user/apps/logstash/logstash core/lib/logstash/pipeline.rb:279)”,“org.jruby.RubyArray.each(org/jruby/RubyArray.java:1613)”,“RUBY.register_插件(/home1/user/apps/logstash/logstash core/lib/logstash/pipeline.rb:279)”,“RUBY.start_工人(/home1/user/apps/logstash/logstash/stash-core/lib/logstash/pipepeline.rb:288)”,“RUBY.run”(/home1/user/apps/logstash/logstash-core/lib/logstash/pipeline.rb:214)”,“RUBY.start_管道(/home1/user/apps/logstash/logstash-core/lib/logstash/agent.rb:398)”,“java.lang.Thread.run(java/lang/Thread.java:745)”]
[2017-09-06T18:49:14837][FATAL][logstash.runner]发生意外错误!{:error=>#,:backtrace=>[“org/logstash/ext/jrubyventextlibrary.java:202:in`sprintf'”、/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/common.rb:173:in`event"行动参数中的“/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/common.rb:48:in`event\u action\u tuple'”,/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/common.rb:42:in'multi\u接收',“org/jruby/RubyArray.java:2414:in`map'”/home1/user/apps/logstash/vendor/bundle/jruby/1.9/gems/logstash-output-elasticsearch-7.3.5-java/lib/logstash/outputs/elasticsearch/common.rb:42:in`multi_receive'”/home1/user/apps/logstash/logstash-core/lib/logstash/output_delegator\u-strategies/shared.rb:13:in`multi_receive'”/home1/user/apps/logstash/logstash core/lib/logstash/output_delegator.rb:47:in‘multi_receive’,“/home1/user/apps/logstash/logstash/core/lib/logstash/pipeline.rb:407:in‘output_batch’,‘org/jruby/RubyHash.java:1342:in‘each’,/home1/user/apps/logstash/logstash core/lib/logstash/logstash