rabbitmq / logstash丢失的消息

格伦纳德

我有一个Rabbitmq,可以成功存储消息,但是读取队列的logstash忽略了我的大多数消息。

RabbitMQ是可以的,我有一个小的python脚本来显示所有消息

import pika
i=0
def on_message(channel, method_frame, header_frame, body):
    global i
    print i
    print("Message body", body)
    channel.basic_ack(delivery_tag=method_frame.delivery_tag)
    i+=1

credentials = pika.PlainCredentials('***', '***')
parameters =  pika.ConnectionParameters('***',5672,'logstash', credentials=credentials)
connection = pika.BlockingConnection(parameters)

channel = connection.channel()
channel.exchange_declare(exchange="logstash", exchange_type="topic", passive=False, durable=True, auto_delete=False)
channel.queue_declare(queue="hbbtv", auto_delete=False, durable=True)
channel.queue_bind(queue="hbbtv", exchange="logstash", routing_key="hbbtv")
channel.basic_qos(prefetch_count=1)

channel.basic_consume(on_message, 'hbbtv')

try:
    channel.start_consuming()
except KeyboardInterrupt:
    channel.stop_consuming()

connection.close()

我可以看到我所有的消息

12(“消息正文”,“ {“消息”:“ 212.95.70.118--[25 / Feb / 2016:11:19:53 +0100] \” GET /services/web/index.php/OPA/categories/ ARTEPLUS7 / fr HTTP / 1.1 \“ 200 348 \” http://www.arte.tv/hbbtvv2/notv/cehtml/index.cehtml?lang = de_DE&page = PLUS7&tv = false \“ \” Opera / 9.80(Linux armv7l; HbbTV / 1.1.1(; Philips;;; PhilipsTV;)CE-HTML / 1.0 NETTV / 4.3.1 PhilipsTV / 2.1.1固件/003.015.000.001(PhilipsTV,2.1.1 ,)en)Presto / 2.12.362版本/12.11 \“ hbbtvdyn.arte.tv”,“ @ version”:“ 1”,“ @ timestamp”:“ 2016-02-25T10:19:53.000Z”,“路径“:” /数据/日志/访问“,”主机“:” arte-hbbtvdyn-web1.sdv.fr“,”类型“:” apache-access“,”应用程序“:” hbbtv“,” clientip“:” 212.95.70.118“,” ident“:”-“,” auth“:”-“,” timestamp“:” 25 / Feb / 2016:11:19:53 +0100“,” verb“:” GET“,” request“:” / services / web / index.php / OPA / categories / ARTEPLUS7 / fr“,” httpversion“:” 1.1“,”响应”:“ 200”,“字节”:“ 348”,“引荐来源网址”:“ \” http://www.arte.tv/hbbtvv2/notv/cehtml/index.cehtml?lang = de_DE&page = PLUS7&tv = false \“”,“ agent”:“ \” Opera / 9.80(Linux armv7l; HbbTV / 1.1.1(; Philips;;; PhilipsTV;)CE-HTML / 1.0 NETTV / 4.3.1 PhilipsTV / 2.1.1固件/003.015。 000.001(PhilipsTV,2.1.1,)zh)Presto / 2.12.362版本/12.11 \“”,“ targethost”:“ hbbtvdyn.arte.tv”,“ geoip”:{“ ip”:“ 212.95.70.118”, “ country_code2”:“ FR”,“ country_code3”:“ FRA”,“ country_name”:“法国”,“ continent_code”:“ EU”,“ region_name”:“ C1”,“ city_name”:“史特拉斯堡”,“纬度“:48.60040000000001,”经度“:7.787399999999991,”时区“:”欧洲/巴黎“,” real_region_name“:”阿尔萨斯“,”位置“:[7.787399999999991,48.60040000000001]}}')13('消息正文','{“消息”:“ 212.95.70.118--[25 / Feb / 2016:11:19:53 +0100] \” GET /services/web/index.php/OPA/videos / highlights / 6 / ARTEPLUS7 / de / GE HTTP / 1.1 \“ 500 4519 \” http://www.arte.tv/hbbtvv2/notv/cehtml/index.cehtml?lang = de_DE&page = PLUS7&tv = false \“ \” Opera / 9.80(Linux armv7l; HbbTV / 1.1.1(; Philips;;; PhilipsTV;)CE-HTML / 1.0 NETTV / 4.3.1 PhilipsTV / 2.1.1固件/003.015.000.001(PhilipsTV,2.1.1 ,)en)Presto / 2.12.362版本/12.11 \“ hbbtvdyn.arte.tv”,“ @ version”:“ 1”,“ @ timestamp”:“ 2016-02-25T10:19:53.000Z”,“路径“:” /数据/日志/访问“,”主机“:” arte-hbbtvdyn-web1.sdv.fr“,”类型“:” apache-access“,”应用程序“:” hbbtv“,” clientip“:” 212.95.70.118“,” ident“:”-“,” auth“:”-“,” timestamp“:” 25 / Feb / 2016:11:19:53 +0100“,” verb“:” GET“,” request“:” / services / web / index.php / OPA / videos / highlights / 6 / ARTEPLUS7 / de / GE“,” httpversion“:” 1.1“,“ response”:“ 500”,“ bytes”:“ 4519”,“ referrer”:“ \” http://www.arte.tv/hbbtvv2/notv/cehtml/index.cehtml?lang=de_DE&page=PLUS7&tv=false \“”,“ agent”:“ \” Opera / 9.80(Linux armv7l; HbbTV / 1.1.1(; Philips;;; PhilipsTV;)CE-HTML / 1.0 NETTV / 4.3.1 PhilipsTV / 2.1.1固件/003.015。 000.001(PhilipsTV,2.1.1,)zh)Presto / 2.12.362版本/12.11 \“”,“ targethost”:“ hbbtvdyn.arte.tv”,“ geoip”:{“ ip”:“ 212.95.70.118”, “ country_code2”:“ FR”,“ country_code3”:“ FRA”,“ country_name”:“法国”,“ continent_code”:“ EU”,“ region_name”:“ C1”,“ city_name”:“史特拉斯堡”,“纬度“:48.60040000000001,”经度“:7.787399999999991,”时区“:”欧洲/巴黎“,” real_region_name“:”阿尔萨斯“,”位置“:[7.787399999999991,48.60040000000001]}}')14('邮件正文','{“ message”:“ 212.95.70.119--[25 / Feb / 2016:11:19:53 +0100] \” GET /OPA/getOPAData.php?url=videoStreams%3Flanguage%3Dfr%26protocol %3DHTTP%26mediaType%3Dmp4%26quality%3DEQ%2CSQ%2CHQ%26profileAmm%3D%24nin%3AAMM-YTFR-HAB%2CAMM-YTFR%2CAMM-DT%26kind%3DSHOW%26availableScreens%3Dtv%26fields%3DprogramId%Curl %2CaudioSlot%2CaudioCode%2CaudioLabel%2CaudioShortLabel%2Cchannel%26programId%3D048353-033-A%26platform%3DARTEPLUS7&filename = PLUS7_stream_048353-033-A_fr_FR.json HTTP / 1.1 \“ 200 5508 \”-\“ \” Mozilla / 5.0(Linux; Tizen 2.3; SmartHub; SMART-TV; SmartTV; U; Maple2012)AppleWebKit / 538.1 +(KHTML,例如Gecko)TV Safari / 538.1 + \“ hbbtvdyn.arte.tv”,“ @ version”:“ 1”,“ @ timestamp“:” 2016-02-25T10:19:53.000Z“,” path“:”/ data / logs / access“,”主机“:” arte-hbbtvdyn-web1.sdv.fr“,”类型“:” apache-access“,”应用程序“:” hbbtv“,” clientip“:” 212.95.70.119 “,” ident“:”-“,” auth“:”-“,” timestamp“:” 25 / Feb / 2016:11:19:53 +0100“,” verb“:” GET“,” request“: “ /OPA/getOPAData.php?url=videoStreams%3Flanguage%3Dfr%26protocol%3DHTTP%26mediaType%3Dmp4%26quality%3DEQ%2CSQ%2CHQ%26profileAmm%3D%24nin%3AAMM-YTFR-HAB%2CAMM-YTFR%2CAMM- DT%26kind%3DSHOW%26availableScreens%3Dtv%26fields%3DprogramId%2Curl%2Cquality%2CaudioSlot%2CaudioCode%2CaudioLabel%2CaudioShortLabel%2Cchannel%26programId%3D048353-033-A%26platform%3DARTEPLUS__FR_3_FR_A_FR_7_filename = PLUS。 httpversion“:” 1.1“,”response“:” 200“,” bytes“:” 5508“,” referrer“:” \“-\”“,” agent“:” \“ Mozilla / 5.0(Linux; Tizen 2.3; SmartHub; SMART-TV; SmartTV ; U; Maple2012)AppleWebKit / 538.1 +(KHTML,例如Gecko)TV Safari / 538.1 + \“”,“ targethost”:“ hbbtvdyn.arte.tv”,“ geoip”:{“ ip”:“ 212.95.70.119” ,“ country_code2”:“ FR”,“ country_code3”:“ FRA”,“ country_name”:“法国”,“ continent_code”:“ EU”,“ region_name”:“ C1”,“ city_name”:“斯特拉斯堡”,“纬度”:48.60040000000001,“经度”:7.787399999999991,“时区”:“欧洲/巴黎”,“ real_region_name”:“阿尔萨斯”,“位置”:[7。787399999999991,48.60040000000001]}}')

带有良好的速率消息(每秒几条),我绝对不会抱怨解析失败。

因此,问题发生在logstash读取消息时。问题是

  • 很多消息丢失
  • 所有消息都具有_grokparsefailure,即使它已完成

Elasticsearch中的消息

logstash的输入部分是

rabbitmq {
    host=>"arte-elasticlog.sdv.fr"
    user=>"***"
    password=>"***"
    queue=>"hbbtv"
    vhost=>"logstash"
    port=>5672
    auto_delete=>false
    durable=>true
    type => "rabbit_hbbtv"
  }
格伦纳德

问题出在我的logstash过滤器上,我有两个apache访问权限,但是使用了不同的模式,因此当logstash尝试解析消息时,有时他的模式很好->在ES中,有时没有->没有消息。

现在,对于我所有的不同日志,我添加(添加字段)

application-->"my application name"

在我的输入中,我所有的grok过滤器都取决于应用程序。

现在一切都很好,谢谢您的帮助。

本文收集自互联网,转载请注明来源。

如有侵权,请联系[email protected] 删除。

编辑于
0

我来说两句

0条评论
登录后参与评论

相关文章