Logstash一开始崩溃

正如标题所述，Logstash一开始就崩溃了。
我通过Docker运行它。

这是我的输出：

logstash_1 | {:timestamp=>"2016-10-25T13:14:31.470000+0000", :message=>"Reading config file", :config_file=>"/etc/logstash/conf.d/logstash.conf", :level=>:debug, :file=>"logstash/config/loader.rb", :line=>"69", :method=>"local_config"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.570000+0000", :message=>"Plugin not defined in namespace, checking for plugin file", :type=>"output", :name=>"stdout", :path=>"logstash/outputs/stdout", :level=>:debug, :file=>"logstash/plugin.rb", :line=>"86", :method=>"lookup"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.584000+0000", :message=>"starting agent", :level=>:info, :file=>"logstash/agent.rb", :line=>"213", :method=>"execute"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.585000+0000", :message=>"starting pipeline", :id=>"main", :level=>:info, :file=>"logstash/agent.rb", :line=>"487", :method=>"start_pipeline"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.606000+0000", :message=>"Plugin not defined in namespace, checking for plugin file", :type=>"codec", :name=>"rubydebug", :path=>"logstash/codecs/rubydebug", :level=>:debug, :file=>"logstash/plugin.rb", :line=>"86", :method=>"lookup"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.632000+0000", :message=>"config LogStash::Codecs::RubyDebug/@metadata = false", :level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"154", :method=>"config_init"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.789000+0000", :message=>"config LogStash::Outputs::Stdout/@codec = <LogStash::Codecs::RubyDebug metadata=>false>", :level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"154", :method=>"config_init"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.791000+0000", :message=>"config LogStash::Outputs::Stdout/@workers = 1", :level=>:debug, :file=>"logstash/config/mixin.rb", :line=>"154", :method=>"config_init"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.796000+0000", :message=>"Will start workers for output", :worker_count=>1, :class=>"LogStash::Outputs::Stdout", :level=>:debug, :file=>"logstash/output_delegator.rb", :line=>"77", :method=>"register"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.812000+0000", :message=>"Starting pipeline", :id=>"main", :pipeline_workers=>2, :batch_size=>125, :batch_delay=>5, :max_inflight=>250, :level=>:info, :file=>"logstash/pipeline.rb", :line=>"188", :method=>"start_workers"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.816000+0000", :message=>"Pipeline main started", :file=>"logstash/agent.rb", :line=>"491", :method=>"start_pipeline"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.826000+0000", :message=>"Input plugins stopped! Will shutdown filter/output workers.", :level=>:info, :file=>"logstash/pipeline.rb", :line=>"148", :method=>"run"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.935000+0000", :message=>"Pushing flush onto pipeline", :level=>:debug, :file=>"logstash/pipeline.rb", :line=>"458", :method=>"flush"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.942000+0000", :message=>"Pushing shutdown", :thread=>"#<Thread:0x6d334b22 run>", :level=>:debug, :file=>"logstash/pipeline.rb", :line=>"395", :method=>"shutdown_workers"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.946000+0000", :message=>"Pushing shutdown", :thread=>"#<Thread:0x30e6a1db sleep>", :level=>:debug, :file=>"logstash/pipeline.rb", :line=>"395", :method=>"shutdown_workers"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.957000+0000", :message=>"Shutdown waiting for worker thread #<Thread:0x6d334b22>", :level=>:debug, :file=>"logstash/pipeline.rb", :line=>"400", :method=>"shutdown_workers"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.963000+0000", :message=>"Shutdown waiting for worker thread #<Thread:0x30e6a1db>", :level=>:debug, :file=>"logstash/pipeline.rb", :line=>"400", :method=>"shutdown_workers"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.970000+0000", :message=>"closing output delegator", :klass=>"LogStash::Outputs::Stdout", :level=>:debug, :file=>"logstash/output_delegator.rb", :line=>"137", :method=>"do_close"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.972000+0000", :message=>"closing", :plugin=>"LogStash::Outputs::Stdout", :level=>:debug, :file=>"logstash/plugin.rb", :line=>"37", :method=>"do_close"} logstash_1 | {:timestamp=>"2016-10-25T13:14:31.976000+0000", :message=>"Pipeline main has been shutdown", :file=>"logstash/agent.rb", :line=>"491", :method=>"start_pipeline"} logstash_1 | {:timestamp=>"2016-10-25T13:14:34.823000+0000", :message=>"stopping pipeline", :id=>"main", :file=>"logstash/agent.rb", :line=>"406", :method=>"shutdown_pipelines"} logstash_1 | {:timestamp=>"2016-10-25T13:14:34.830000+0000", :message=>"Closing inputs", :level=>:info, :file=>"logstash/pipeline.rb", :line=>"384", :method=>"shutdown"} logstash_1 | {:timestamp=>"2016-10-25T13:14:34.832000+0000", :message=>"Closed inputs", :level=>:info, :file=>"logstash/pipeline.rb", :line=>"386", :method=>"shutdown"} 

这是我的logstash.conf文件：

 input { } filter { } output { stdout { codec => rubydebug # for debugging } } 

当我运行logstash -t logstash.conf时，它检查出来，所以这不是configuration文件的问题。

这个问题可能是什么？
cat'ing meminfo显示：

 MemTotal: 3797716 kB MemFree: 334368 kB 

top显示：

 top - 15:22:36 up 1 day, 1:42, 2 users, load average: 0,52, 0,53, 0,80 Tasks: 298 total, 1 running, 297 sleeping, 0 stopped, 0 zombie %Cpu(s): 2,1 us, 2,4 sy, 0,0 ni, 94,4 id, 0,2 wa, 0,0 hi, 0,9 si, 0,0 st KiB Mem : 3797716 total, 325552 free, 1956392 used, 1515772 buff/cache KiB Swap: 4063228 total, 4059964 free, 3264 used. 1610224 avail Mem 

似乎不是一个硬件问题。
一个好奇的是运行elasticsearch的日志消息：
elasticsearch_1 | [2016-10-25 12:37:01,076][WARN ][bootstrap ] unable to install syscall filter: seccomp unavailable: your kernel is buggy and you should upgrade
但是这对logstash的运行没有任何影响，实际上elasticsearch容器运行得很好。

编辑：
docker-compose.yaml for ELK-stack：

 ############## ## ELK STACK ############## version: '2' services: elasticsearch: image: 'elasticsearch:latest' ports: - "xxxx:xxxx" networks: - net logstash: build: './logstash_image' links: - elasticsearch ports: #in1 - "xxxx:xxxx" #in2 - "xxxx:xxxx" #in3 - "xxxx:xxxx" #in4 - "xxxx:xxxx" #in5 - "xxxx:xxxx" networks: - net # network_mode: host # set up same network values as host (debug only) # TODO: limit/rotate docker logs: # https://docs.docker.com/compose/compose-file/#/logopt # https://docs.docker.com/compose/compose-file/#logdriver kibana: image: 'kibana:latest' ports: - 'xxxx:xxxx' links: - elasticsearch volumes: - ./kibana.yml:/opt/kibana/config/kibana.yml networks: - net networks: net: driver: bridge ipam: driver: default config: - subnet: xxx.xxx.xxx.xxx/xx ip_range: yyy.yyy.yyy.yyy/yy gateway: zzz.zzz.zzz.zzz 

Answer 1

Logstash不会崩溃 ，因为您的configuration文件明确指定了一个空的input源（ input {} ），所以它只是退出。 日志pipe道没有任何types的数据源（默认情况下，它至less有STDIN作为数据源），所以它只是退出。

请注意 ，使用input {}显式定义空input是不同的，并且不定义任何input（在这种情况下，Logstash将默认input { stdin { type => stdin } }作为默认值并侦听STDINstream上的数据input） 。

这个行为在Logstash的帮助输出（ logstash agent --help ）中定义（强调我的）：

-e CONFIG_STRING – 使用给定的string作为configuration数据。 与configuration文件相同的语法。 如果没有指定input，则使用以下内容作为默认input ： input { stdin { type => stdin } } […]