logstash 常见解决方法

1. logstash 无法连接 kafka

logstash 版本:   logstash-1.5.4-1.noarch.rpm

logstash.log 错误信息:

{:timestamp=>"2015-11-16T18:41:00.365000+0800", :message=>"The error reported is: \n uninitialized constant Concurrent::Delay::Executor"} 解决方法:

降级版本就可以:   logstash-1.5.2-1.noarch.rpm

2. 降级后发现 grok 匹配完全错误了

把之前  logstash-1.5.4-1.noarch.rpm   grok   patterns 进行替换就可以

grok 语法匹配必须要根据不同版本的  patterns  使用不同语法

默认位置 

rpm -ql logstash | grep grok | grep patterns 简单升级方法

/opt/logstash/bin/plugin update grok 也可以从其他 rpm 包中直接提取文件, 如

/opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.3.0/patterns/grok-patterns

3. 输出详细日志方法

[root@hh-yun-pinyun-129181 ~]# grep LS_OPTS /etc/init.d/logstash LS_OPTS="--verbose"

4 验证配置文件是否正确方法

/opt/logstash/bin/logstash --configtest -f /etc/logstash/conf.d/hh-yun.conf Configuration OK

5. 常见日志错误如下

tail -f  /var/log/logstash-forwarder/logstash-forwarder.err 2015/12/07 17:43:30.961175 Failed to tls handshake with 10.199.129.61 x509: cannot validate certificate for 10.199.129.61 because it doesn't contain any IP SANs

解决:

vim /etc/pki/tls/openssl.cnf [ v3_ca ] subjectAltName=IP:10.199.129.61 <-添加对应信息 重新创建密钥对 openssl req -subj '/CN=hh-yun-haproxy-129061.vclound.com/' -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout /etc/pki/tls/private/logstash-forwarder.key -out /etc/pki/tls/certs/logstash-forwarder.crt 重启服务 [root@hh-yun-haproxy-129061 ~]# service  logstash-forwarder restart logstash-forwarder stopped. logstash-forwarder started

6. 增大事件传输数量

vim /etc/init.d/logstash-forwarder args=-config\ /etc/logstash-forwarder.conf\ -spool-size\ 4096\ -harvest-buffer-size\ 32768 相关资源：敏捷开发V1.0.pptx