阿里云服務器?CentOS Linux release 7.4.1708 (Core)

Java(TM) SE Runtime Environment (build 1.8.0_151-b12)

logstash-6.5.0

-------------------------------------------------------------------------------------------

使用控制臺輸入控制臺輸出時，啟動正常，沒問題。

使用filebeat輸入，控制臺輸出時報錯，但可以正常接收到filebeat傳過來的內容。配置文件如下：

input {

? ? beats {

? ? ? ? port => 9011

? ? }

}

filter {

}

output {

? ? stdout {

? ? ? ? codec=>rubydebug

? ? }

}

指定監聽端口9011。

啟動logstash：

./bin/logstash?-f?config/filebeat_std.conf

啟動后日志如下：

Sending Logstash logs to /usr/share/kkitsupadm/elk/logstash-6.4.3/logs which is now configured via log4j2.properties

[2018-11-16T16:17:24,741][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified

[2018-11-16T16:17:25,664][INFO ][logstash.runner? ? ? ? ? ] Starting Logstash {"logstash.version"=>"6.4.3"}

[2018-11-16T16:17:29,219][INFO ][logstash.pipeline? ? ? ? ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}

[2018-11-16T16:17:29,830][INFO ][logstash.inputs.beats? ? ] Beats inputs: Starting input listener {:address=>"0.0.0.0:9011"}

[2018-11-16T16:17:29,866][INFO ][logstash.pipeline? ? ? ? ] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x5aeab466 run>"}

[2018-11-16T16:17:29,971][INFO ][logstash.agent? ? ? ? ? ?] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

[2018-11-16T16:17:30,055][INFO ][org.logstash.beats.Server] Starting server on port: 9011

[2018-11-16T16:17:30,619][INFO ][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:9011, remote: undefined] Handling exception: Connection reset by peer

[2018-11-16T16:17:30,628][WARN ][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.

java.io.IOException: Connection reset by peer

at sun.nio.ch.FileDispatcherImpl.read0(Native Method) ~[?:1.8.0_151]

at sun.nio.ch.SocketDispatcher.read(SocketDispatcher.java:39) ~[?:1.8.0_151]

at sun.nio.ch.IOUtil.readIntoNativeBuffer(IOUtil.java:223) ~[?:1.8.0_151]

at sun.nio.ch.IOUtil.read(IOUtil.java:192) ~[?:1.8.0_151]

at sun.nio.ch.SocketChannelImpl.read(SocketChannelImpl.java:380) ~[?:1.8.0_151]

at io.netty.buffer.PooledUnsafeDirectByteBuf.setBytes(PooledUnsafeDirectByteBuf.java:288) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]

at io.netty.buffer.AbstractByteBuf.writeBytes(AbstractByteBuf.java:1108) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]

at io.netty.channel.socket.nio.NioSocketChannel.doReadBytes(NioSocketChannel.java:345) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]

at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:126) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]

at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:645) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]

at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:580) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]

at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:497) ~[netty-all-4.1.18.Final.jar:4.1.18.Final]

at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:459) [netty-all-4.1.18.Final.jar:4.1.18.Final]

at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:858) [netty-all-4.1.18.Final.jar:4.1.18.Final]

at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [netty-all-4.1.18.Final.jar:4.1.18.Final]

at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]

[2018-11-16T16:17:30,637][INFO ][org.logstash.beats.BeatsHandler] [local: 0.0.0.0:9011, remote: undefined] Handling exception: Connection reset by peer

[2018-11-16T16:17:30,638][WARN ][io.netty.channel.DefaultChannelPipeline] An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.

而我在另一臺我們自己搭的服務器上啟動時，正常啟動，日志如下：

Sending Logstash logs to /opt/elk/logstash-6.4.3/logs which is now configured via log4j2.properties

[2018-11-16T16:11:54,903][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified

[2018-11-16T16:11:57,971][INFO ][logstash.runner? ? ? ? ? ] Starting Logstash {"logstash.version"=>"6.4.3"}

[2018-11-16T16:12:12,528][INFO ][logstash.pipeline? ? ? ? ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>4, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}

[2018-11-16T16:12:13,325][INFO ][logstash.inputs.beats? ? ] Beats inputs: Starting input listener {:address=>"0.0.0.0:9011"}

[2018-11-16T16:12:13,439][INFO ][logstash.pipeline? ? ? ? ] Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x186a652 run>"}

[2018-11-16T16:12:13,836][INFO ][logstash.agent? ? ? ? ? ?] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}

[2018-11-16T16:12:14,071][INFO ][org.logstash.beats.Server] Starting server on port: 9011

[2018-11-16T16:12:15,395][INFO ][logstash.agent? ? ? ? ? ?] Successfully started Logstash API endpoint {:port=>9600}????????