无法获取kibana中的索引相关数据-Notableotfetchtheindicesrelateddatainkibana

I am able to create the indices using logstash.conf. My input type is gelf. I am sending the logstash logs to kibana. Here is my logstash.conf

我可以使用logstash.conf创建索引。我的输入类型是gelf。我正在将logstash日志发送给kibana。这是我的logstash.conf

input 
{ gelf { } 
} 
output 

{
 stdout { codec => rubydebug }
 elasticsearch {
  hosts =>  ["elk.lera.com:80"]
  index => "templeton-math-%{+YYYY.MM.dd}"
 }

elasticsearch {
  hosts =>  ["elk.lera.com:80"]
  index => "templeton-science-%{+YYYY.MM.dd}"
 }
 elasticsearch {
  hosts =>  ["elk.lera.com:80"]
  index => "templeton-bio-%{+YYYY.MM.dd}"
 }
 elasticsearch {
  hosts =>  ["elk.lera.com:80"]
  index => "templeton-lang-%{+YYYY.MM.dd}"
 }
}

Issue: logs are sent to all the indices now. I would like to send the logs to respective indices.

问题:现在将日志发送到所有索引。我想将日志发送到各自的索引。

I have added like

我添加了喜欢

if[tag] == "templeton-math"{
elasticsearch {
  hosts =>  ["elk.lera.com:80"]
  index => "templeton-math-%{+YYYY.MM.dd}"
 }
}

It is giving an error INFO logstash.agent - No persistent UUID file found. Generating new UUID {:uuid=>"67f7a48e-fc7c-499b-85a0-3fd6979f88f6", :path=>"/var/lib/logstash/uuid"} 14:58:14.308 [LogStash::Runner] ERROR logstash.agent - Cannot create pipeline {:reason=>"Expected one of #, => at line 22, column 9 (byte 179) after output \n\n{\n\n elasticsearch {\n hosts "} 2017-10-11 14:58:14,355 Api Webserver ERROR No log4j2 configuration file found. Using default configuration: logging only errors to the console.

它给出了错误INFO logstash.agent - 找不到持久性UUID文件。生成新的UUID {:uuid =>“67f7a48e-fc7c-499b-85a0-3fd6979f88f6”,:path =>“/ var / lib / logstash / uuid”} 14:58:14.308 [LogStash :: Runner] ERROR logstash.agent - 输出后无法创建管道{:reason =>“第22行第9行(字节179)中的#,=>预期之一\ n \ n {\ n \ n elasticsearch {\ n hosts”} 2017-10-11 14:58:14,355 Api Webserver ERROR未找到log4j2配置文件。使用默认配置:仅将错误记录到控制台。

1 个解决方案

output {
    stdout { codec => rubydebug }

    if [tag] == "templeton-math" {
        elasticsearch {
            hosts =>  ["elk.lera.com:80"]
            index => "templeton-math-%{+YYYY.MM.dd}"
        }
    }

    if [tag] == "templeton-science" {
        elasticsearch {
            hosts =>  ["elk.lera.com:80"]
            index => "templeton-science-%{+YYYY.MM.dd}"
        }
    }

    if [tag] == "templeton-bio" {
        elasticsearch {
            hosts =>  ["elk.lera.com:80"]
            index => "templeton-bio-%{+YYYY.MM.dd}"
        }

    }

    if [tag] == "templeton-lang" {
        elasticsearch {
            hosts =>  ["elk.lera.com:80"]
            index => "templeton-lang-%{+YYYY.MM.dd}"
        }
    }
}