elasticsearch 我无法在我的机器上启动日志存储。内部错误消息

以下是教程中的测试命令：

./logstash -e 'input { stdin { } } output { stdout {} }'

以下是错误

WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path //usr/share/logstash/config/log4j2.properties. Using default config which logs to console
01:55:14.242 [main] FATAL logstash.runner - An unexpected error occurred! {:error=>#<ArgumentError: Path "/usr/share/logstash/data" must be a writable directory. It is not writable.>, :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:433:in `validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:216:in `validate_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:132:in `validate_all'", "org/jruby/RubyHash.java:1342:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:131:in `validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:217:in `execute'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:185:in `run'", "/usr/share/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:in `run'", "/usr/share/logstash/lib/bootstrap/environment.rb:71:in `(root)'"]}

该目录由logstash拥有并可写

---

有人能提出解决方案吗？

您必须在sudo模式下启动logstash。就是

host@host:~$ sudo su
root@host:/home/host# cd /usr/share/logstash
root@host:/usr/share/logstash# ./bin/logstash -e 'input { stdin { } } output { stdout {} }'
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs to console
16:18:33.959 [[main]-pipeline-manager] INFO  logstash.pipeline - Starting pipeline {"id"=>"main", "pipeline.workers"=>8, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>5, "pipeline.max_inflight"=>1000}
16:18:33.996 [[main]-pipeline-manager] INFO  logstash.pipeline - Pipeline main started
The stdin plugin is now waiting for input:
16:18:34.019 [Api Webserver] INFO  logstash.agent - Successfully started Logstash API endpoint {:port=>9600}
Hello
2017-06-10T15:18:43.457Z host Hello

---

异常消息告诉您logstash找不到configure属性，因此您应该在命令中添加一个标志来告诉logstash configure属性。另一个异常是logstash无法向/usr/share/logstash/data写入内容，您应该使用“sudo”启动此命令，或者您可以将/usr/share/logstash/data的写入权限添加到您的帐户中

日志存储版本：5.5.2

操作系统版本：ubuntu 16.04

启动logstash as flow的命令：

sudo bin/logstash -e 'input { stdin { } } output { stdout {} }' --path.settings=/etc/logstash

---

ps：我通过apt install安装logstash，您应该以

logstash

用户的身份运行它，而不是

root

或任何其他用户-这就是为什么它属于

logstash

用户的原因。因此，请使用以下内容：

sudo -Hu logstash /usr/share/logstash/bin/logstash -e 'input { stdin { } } output { stdout {} }'

此处的主要部分是以

logstash

user的身份运行命令：

sudo -Hu logstash <command you want to run>

sudo-Hu logstash

您可以创建日志存储数据目录，并使用

--path.data logstash data

将当前目录中的日志存储数据用作日志存储数据目录

sudo -Hu logstash <command you want to run>