logstash未解析输出文件和编解码器的配置

我正在尝试一个“简单”的日志存储配置，并希望输出一个文件进行检查。所以我从中获取了conf并将其放入我的conf中：

input {                                                                                                                                                                                                                                   
  file {
    exclude => ['*.gz']
    path => ['/var/log/*.log']
    type => 'system logs'
  }
  syslog {
    port => 5000
  }
}

output {
  elasticsearch {
    hosts => ['elasticsearch']
  }

  file {
    path => "/config/logstash_out.log"
    codec => {
      line  {
        format => "message: %{message}"
      }
    }
  }

  stdout {}
}

但是当我启动它时（

sudocker run-it--rm--name logstash-p514:5000--link elasticsearch:elasticsearch-v“$PWD”：/config logstash logstash-f/config/logstash.conf

），我收到了logstash的投诉：

fetched an invalid config 
{:config=>"input {
  file {
    exclude => ['*.gz']
    path => ['/var/log/*.log']
    type => 'system logs'
  }
  syslog {
    port => 5000
  }
}
output {
  elasticsearch {
    hosts => ['elasticsearch']
  }

  file {
    path => \"/config/logstash_out.log\"
    codec => { 
      line  { 
        format => \"message: %{message}\"
      }
    }
  }

  stdout {}
}"
, :reason=>"Expected one of #, => at line 20, column 13 (byte 507) 
after output {  elasticsearch {\n    hosts => ['elasticsearch']\n  }
\n\n  file {\n    path => \"/config/logstash_out.log\"\n    
codec => { \n      line  ", :level=>:error}

（我重新格式化了一点，这样更容易阅读）

你知道为什么吗？我看到了，但是建议的解决方案被标记为不推荐，所以我想避免

---

谢谢

您的格式与教程一样错误。 这是

不是

codec => { 
      line  { 
        format => \"message: %{message}\"
      }
     }

但事实确实如此

codec =>
      line  {
        format => "message: %{message}"
      }

您不需要在行的周围添加奇怪的括号

这是正确的配置

input {                                                                                                                                                                                                                                   
  file {
    exclude => ['*.gz']
    path => ['/var/log/*.log']
    type => 'system logs'
  }
  syslog {
    port => 5000
  }
}

output {
  elasticsearch {
    hosts => ['elasticsearch']
  }

  file {
    path => "/config/logstash_out.log"
    codec =>
      line  {
        format => "message: %{message}"
      }

  }

  stdout {}
}

---

您的格式与教程一样错误。 这是

不是

codec => { 
      line  { 
        format => \"message: %{message}\"
      }
     }

但事实确实如此

codec =>
      line  {
        format => "message: %{message}"
      }

您不需要在行的周围添加奇怪的括号

这是正确的配置

input {                                                                                                                                                                                                                                   
  file {
    exclude => ['*.gz']
    path => ['/var/log/*.log']
    type => 'system logs'
  }
  syslog {
    port => 5000
  }
}

output {
  elasticsearch {
    hosts => ['elasticsearch']
  }

  file {
    path => "/config/logstash_out.log"
    codec =>
      line  {
        format => "message: %{message}"
      }

  }

  stdout {}
}