[2024-04-10T14:02:09,005][WARN ][logstash.outputs.elasticsearch] Attempted to resurrect connection to dead ES instance, but got an error. {:url=>"http://192.168.100.44:9200/", :error_type=>LogStash::Outputs::ElasticSearch::HttpClient::Pool::HostUnreachableError, :error=>"Elasticsearch Unreachable: [http://192.168.100.44:9200/][Manticore::SocketException] 拒绝连接 (Connection refused)"}
[root@cong11 ~]# su elk 切换普通用户 [elk@cong11 elasticsearch-7.3.0]$ ls bin config jdk lib LICENSE.txt logs modules NOTICE.txt plugins README.textile [elk@cong11 elasticsearch-7.3.0]$ ./bin/elasticsearch 在普通用户启动 [root@cong11 ~]# logstash -f /usr/local/logstash-7.3.0/config/logstash.conf 退出普通用户执行
结果
[2024-04-10T14:17:38,399][INFO ][logstash.javapipeline ] Pipeline started {"pipeline.id"=>"main"}
[2024-04-10T14:17:39,215][INFO ][filewatch.observingtail ] START, creating Discoverer, Watch with file and sincedb collections
[2024-04-10T14:17:39,525][INFO ][org.logstash.beats.Server] Starting server on port: 5044
[2024-04-10T14:17:39,698][INFO ][logstash.agent ] Pipelines running {:count=>1, :running_pipelines=>[:main], :non_running_pipelines=>[]}
[2024-04-10T14:17:41,955][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
/usr/local/logstash-7.3.0/vendor/bundle/jruby/2.5.0/gems/awesome_print-1.7.0/lib/awesome_print/formatters/base_formatter.rb:31: warning: constant ::Fixnum is deprecated
{
"@timestamp" => 2024-04-10T06:17:43.162Z,
"type" => "messages_log",
"path" => "/var/log/messages",
"host" => "cong11",
"message" => "Apr 10 14:06:45 localhost su: (to elk) root on pts/3",
"@version" => "1"
}
{
"@timestamp" => 2024-04-10T06:17:43.088Z,
"type" => "messages_log",
"path" => "/var/log/messages",
"host" => "cong11",
"message" => "Apr 10 14:05:04 localhost su: (to elk) root on pts/3",
"@version" => "1"
}
{
"@timestamp" => 2024-04-10T06:17:43.165Z,
"type" => "messages_log",
"path" => "/var/log/messages",
"host" => "cong11",
"message" => "Apr 10 14:08:02 localhost su: (to elk) root on pts/3",
"@version" => "1"
}
{
"@timestamp" => 2024-04-10T06:17:43.167Z,
"type" => "messages_log",
"path" => "/var/log/messages",
"host" => "cong11",
"message" => "Apr 10 14:09:59 localhost su: (to elk) root on pts/3",
"@version" => "1"
标签：SocketException,100.44,http,04,17,messages,2024,logstash,log From： https://www.cnblogs.com/dyysh/p/18126063