filebeat导入logstash问题

来源:14-3 Filebeat 简介及流程介绍

万先森是三日

2019-11-11

准备从从客户端上使用filebeat收集日志汇总到logstash,之前10台机器都没有问题,但是之后遇到一个比较棘手的报错信息,我试图在网上搜寻一些线索,但是并没有什么进展,老师能不能帮忙看一下什么原因?
报错信息如下:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[root@img01 filebeat]# ./filebeat -e -c filebeat.yml
runtime: epollwait on fd 4 failed with 38
fatal error: runtime: netpoll failed

runtime stack:
runtime.throw(0x2fb8690, 0x17)
/usr/local/go/src/runtime/panic.go:617 +0x72
runtime.netpoll(0x15d610478879e700, 0xd00000000)
/usr/local/go/src/runtime/netpoll_epoll.go:75 +0x209
runtime.sysmon()
/usr/local/go/src/runtime/proc.go:4326 +0x374
runtime.mstart1()
/usr/local/go/src/runtime/proc.go:1206 +0xc4
runtime.mstart()
/usr/local/go/src/runtime/proc.go:1172 +0x6f

goroutine 1 [runnable, locked to thread]:
regexp/syntax.(*parser).newRegexp(…)
/usr/local/go/src/regexp/syntax/parse.go:94
regexp/syntax.(*parser).collapse(0xc000533560, 0xc0001b82e0, 0x3, 0x4, 0xc0001fb012, 0xc0001fb0e0)
/usr/local/go/src/regexp/syntax/parse.go:373 +0x503
regexp/syntax.(*parser).concat(0xc000533560, 0x2f9435b)
/usr/local/go/src/regexp/syntax/parse.go:313 +0x172
regexp/syntax.Parse(0x2f94359, 0x7, 0xd4, 0x2f8f01d, 0xc0004efe38, 0x1338bf9)
/usr/local/go/src/regexp/syntax/parse.go:891 +0x108a
regexp.compile(0x2f94359, 0x7, 0xc0000000d4, 0x24cdfe0, 0xc000535300, 0x0)
/usr/local/go/src/regexp/regexp.go:168 +0x5a
regexp.Compile(…)
/usr/local/go/src/regexp/regexp.go:131
regexp.MustCompile(0x2f94359, 0x7, 0x0)
/usr/local/go/src/regexp/regexp.go:270 +0x4f
github.com/elastic/beats/vendor/github.com/dop251/goja.init.ializers()
/go/src/github.com/elastic/beats/vendor/github.com/dop251/goja/compiler_expr.go:12 +0xb2

goroutine 34 [syscall]:
os/signal.signal_recv(0x0)
/usr/local/go/src/runtime/sigqueue.go:139 +0x9c
os/signal.loop()
/usr/local/go/src/os/signal/signal_unix.go:23 +0x22
created by os/signal.init.0
/usr/local/go/src/os/signal/signal_unix.go:29 +0x41

goroutine 35 [chan receive]:
github.com/elastic/beats/vendor/k8s.io/klog.(*loggingT).flushDaemon(0x4de3bc0)
/go/src/github.com/elastic/beats/vendor/k8s.io/klog/klog.go:1000 +0x8b
created by github.com/elastic/beats/vendor/k8s.io/klog.init.0
/go/src/github.com/elastic/beats/vendor/k8s.io/klog/klog.go:404 +0x6c
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
我的filebeat.yml文件内容是这样的:
filebeat.inputs:

  • type: log
    enabled: true
    paths: /work/logs/cecsh_access.log
    tags: [“hlwb-shrx-cecsh-10.10.4.149”]
    fields_under_root: true
    output.logstash:
    hosts: [“10.10.9.10:5046”]
    ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    由于之前10台filebeat配置文件都是按照这个格式去编写,并且他们也都是成功上传日志的状态,我不认为这个是配置文件错误导致的启动失败,但是又找不到相应的故障案例可以参考,麻烦老师看一下,您有遇到过诸如此类的报错吗?
写回答

1回答

rockybean

2019-11-11

你这台机器的系统版本估计太老了导致的,一般这种其他机器可以,这台不行的。可以先对比下基本的差异,比如操作系统、内核版本之类的。

参见下面官方论坛的一个错误分析:

https://discuss.elastic.co/t/filebeat-6-on-redhat-rhel-centos-5-not-supported/172049

0
1
万先森是三日
明天尝试一下旧的版本,可能内核太低了
2019-11-11
共1条回复

Elastic Stack从入门到实践,动手搭建数据分析系统

有了Elastic Stack,不用写一行代码,你也可以玩转大数据分析!

1361 学习 · 397 问题

查看课程