데이터 시각화 별거 아니다

2024-04-13

로그스태시는 에러 발생 시 상당히 고약한 트러블슈팅 환경을 제공한다. 물론 원인 파악이 쉬울 때도 있음. remove_field 오타 발생.

1
2
3
4
5
filter {
 mutate {
  remove_fiel => ["@version", "@timestamp", "path", "host"]
 }
}

에러 원인을 정확히 찝어준다.

1
2
[2023-10-22T16:01:47,905][ERROR][logstash.filters.mutate ] Unknown setting 'remove_fiel' for mutate
[2023-10-22T16:01:47,906][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Unable to configure plugins: (ConfigurationError) Something is wrong with your configuration.", :backtrace=>["org.logstash.config.ir.CompiledPipeline.<init>(CompiledPipeline.java:120)", "org.logstash.execution.AbstractPipelineExt.initialize(AbstractPipelineExt.java:186)", "org.logstash.execution.AbstractPipelineExt$INVOKER$i$initialize.call(AbstractPipelineExt$INVOKER$i$initialize.gen)", "D_3a_.ELK.logstash_minus_8_dot_10_dot_3.logstash_minus_core.lib.logstash.pipeline_action.reload.RUBY$method$execute$0(D:/ELK/logstash-8.10.3/logstash-core/lib/logstash/pipeline_action/reload.rb:51)", "D_3a_.ELK.logstash_minus_8_dot_10_dot_3.logstash_minus_core.lib.logstash.agent.RUBY$block$converge_state$2(D:/ELK/logstash-8.10.3/logstash-core/lib/logstash/agent.rb:386)", "org.jruby.runtime.CompiledIRBlockBody.callDirect(CompiledIRBlockBody.java:141)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:64)", "org.jruby.runtime.IRBlockBody.call(IRBlockBody.java:58)", "org.jruby.runtime.Block.call(Block.java:143)", "org.jruby.RubyProc.call(RubyProc.java:352)", "org.jruby.internal.runtime.RubyRunnable.run(RubyRunnable.java:110)", "java.base/java.lang.Thread.run(Thread.java:833)"]}

문제는 안 그럴 때가 많다는 거. ssl_certificate_authorities 오타 발생.

1
2
3
4
5
6
7
8
9
output {
 stdout {}
 elasticsearch {
  hosts => "https://192.168.56.1"
  user => "elastic"
  password => "no1"
  ssl.certificate_authorities => "d:/http_ca.crt"
 }
}

남다른 가독성을 뽐내는 한 줄 에러 메시지.

1
[2023-10-22T16:05:39,693][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Expected one of [A-Za-z0-9_-], [ \\t\\r\\n], \"#\", \"=>\" at line 21, column 6 (byte 328) after output {\r\n\tstdout {}\r\n\telasticsearch {\r\n\t\thosts => \"https://192.168.56.1\"\r\n\t\tuser => \"elastic\"\r\n\t\tpassword => \"no1ids\"\r\n\t\tssl", :backtrace=>["D:/ELK/logstash-8.10.3/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:239:in `initialize'", "org/logstash/execution/AbstractPipelineExt.java:173:in `initialize'", "D:/ELK/logstash-8.10.3/logstash-core/lib/logstash/pipeline_action/reload.rb:51:in `execute'", "D:/ELK/logstash-8.10.3/logstash-core/lib/logstash/agent.rb:386:in `block in converge_state'"]}