Logstashは、私は次の入力のためのlogstashを設定しようとしています

Question

「に無効な設定を読み込むことができません」 - カスタムパターン以下&次nginxのアクセス、nginxのエラー&ログはlogstash.conf

input { 
    beats { 
    port => 5044 

codec => multiline { 
     # Grok pattern names are valid! :) 
     pattern => "^%{TIMESTAMP_ISO8601} " 
     negate => true 
     what => previous 
    } 
    } 
} 

filter { 

if [type] == "nginx-access" { 
     grok { 
     match => [ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra_fields}"] 
     overwrite => [ "message" ] 
     } 

     mutate { 
       convert => ["response", "integer"] 
       convert => ["bytes", "integer"] 
       convert => ["responsetime", "float"] 
     } 

     geoip { 
       source => "clientip" 
       target => "geoip" 
       add_tag => [ "nginx-geoip" ] 
     } 

     date { 
       match => [ "timestamp" , "dd/MMM/YYYY:HH:mm:ss Z" ] 
       remove_field => [ "timestamp" ] 
     } 

     useragent { 
       source => "agent" 
     } 

} else if [type] == "nginx-error" { 
     grok { 
     match => [ "message" , "(?<timestamp>%{YEAR}[./-]%{MONTHNUM}[./-]%{MONTHDAY}[- ]%{TIME}) \[%{LOGLEVEL:severity}\] %{POSINT:pid}#%{NUMBER}: %{GREEDYDATA:errormessage}(?:, client: (?<client>%{IP}|%{HOSTNAME}))(?:, server: %{IPORHOST:server})(?:, request: %{QS:request})?(?:, upstream: \"%{URI:upstream}\")?(?:, host: %{QS:host})?(?:, referrer: \"%{URI:referrer}\")"] 
     overwrite => [ "message" ] 
     } 

geoip { 
       source => "client" 
       target => "geoip" 
       add_tag => [ "nginx-geoip" ] 
     } 

     date { 
       match => [ "timestamp" , "YYYY/MM/dd HH:mm:ss" ] 
       remove_field => [ "timestamp" ] 
     } 

} else { 

    mutate { 
    gsub => ["message", "\n", " "] 
    } 
    grok { 
    match => [ "message", "%{TIMESTAMP_ISO8601:timestamp} \[%{NOTSPACE:uid}\] \[%{NOTSPACE:thread}\] %{LOGLEVEL:loglevel} %{DATA:class}\-%{GREEDYDATA:message}" ] 
    overwrite => [ "message" ] 
    } 
    date { 
    match => [ "timestamp" , "yyyy-MM-dd HH:mm:ss" ] 
    target => "@timestamp" 
    } 
    if "_grokparsefailure" in [tags] { 
      drop { } 
    } 
} 
} 

output { 

stdout { codec => rubydebug } 
if [type] == "nginx-access" { 
    elasticsearch { hosts => localhost } 
    index => "nginx-access-%{+YYYY.MM.dd}" 
} else if [type] == "nginx-error" { 
    elasticsearch { hosts => localhost } 
    index => "nginx-error-%{+YYYY.MM.dd}" 
} else { 
    elasticsearch { hosts => localhost } 
} 

} 

が、実行中にありますそれは次のエラーが表示されます

ERROR logstash.agent - Cannot load an invalid configuration {:reason=>"Expected one of #, { 
at line 84, column 9 (byte 1883) after output {\n \nstdout { codec => rubydebug }\nif [type] == 
\"nginx-access\" {\n elasticsearch { hosts => localhost }\n index "} 

私はこのエラーが何かを確かではありません。誰かが私にそれを理解するのを助けることができる？また、私は何の文字化けがないことを罰金だhexdumpに対して&を実行してみました

は

Answer 1

を入れて「」忘れてしまったと思います内側の弾性サーチブロック以下のように

output { 

stdout { codec => rubydebug } 
if [type] == "nginx-access" { 
    elasticsearch { hosts => localhost 
    index => "nginx-access-%{+YYYY.MM.dd}" 
    } 
} else if [type] == "nginx-error" { 
    elasticsearch { 
     hosts => localhost 
     index => "nginx-error-%{+YYYY.MM.dd}" 
    } 

} else { 
    elasticsearch { 
     hosts => localhost 
    } 
} 
} 

Answer 2

私はあなたが正しい答えが「インデックス」を持っているローカルホスト

elasticsearch { 
    hosts => ["localhost"] 
    index => "%{tempIndex}-%{+xxxx.ww}" 
    document_type => "%{[@metadata][type]}" 
}