Logstash file input: registering json file grew bu

2019-08-30 03:13发布

问题:

My config file is shown below:

input {
  file {
    codec => "json"
    path => "/home/data/*"
    sincedb_path => "/dev/null"
  }
}

output {
  elasticsearch{
    protocol => "http"
    host => "localhost"
    index => "data"
  }
}

When I download a .json file to the data directory, logstash will not receive the data or output to elasticsearch unless I first open the file and save it in gedit.

Running logstash with the -vvv flag shows no errors all I get when a file is put in that directory is

_discover_file: /home/data/*: new: /home/data/prediction1.json (exclude is []) {:level=>:debug, :file=>"filewatch/watch.rb", :line=>"126"}
_open_file: /home/data/prediction1.json: opening {:level=>:debug, :file=>"filewatch/tail.rb", :line=>"98"}
/home/data/prediction1.json: staying at position 0, no sincedb {:level=>:debug, :file=>"filewatch/tail.rb", :line=>"143"}
writing sincedb (delta since last write = 377) {:level=>:debug, :file=>"filewatch/tail.rb", :line=>"177"}
/home/data/prediction1.json: file grew, old size 0, new size 3952 {:level=>:debug, :file=>"filewatch/watch.rb", :line=>"81"}

This led me to believe that there may be a character encoding problem as the json file is created using json.dumps in python before reaching elasticsearch. I tried converting the data to yaml:

outfile.write(yaml.dump(json.dumps(data)))

which logstash accepts as plain text as it is now in the form:

'data:{ properties:
  { location:
  { here }}}'

after using sed and tr commands to convert this BACK to valid json logstash no longer accepts it unless saved through gedit!!!