input { file { path => [‘/gwlog/data/**/*.json‘] discover_interval => 1 ignore_older => 5 start_position => "beginning" close_older => 6 max_open_files => 200000 codec => json } } filter { mutate { remove_field => ["@version","host","path"] } } output { mongodb { codec => json collection => "tst_log" database => "runlog" uri => "mongodb://linge:[email protected]:8021/admin" } stdout{ codec => json } }
若删除@timestamp,插入数据会报错,感觉是插入时用到了@timestamp
2017-09-24T06:15:33,311][WARN ][logstash.outputs.mongodb ] Failed to send event to MongoDB {:event=>%{host} %{message}, :exception=>java.io.IOException: fails, :backtrace=>["org.logstash.Event.getTimestamp(Event.java:119)", "org.logstash.ext.JrubyEventExtLibrary$RubyEvent.ruby_timestamp(JrubyEventExtLibrary.java:290)", "org.logstash.ext.JrubyEventExtLibrary$RubyEvent$INVOKER$i$0$0$ruby_timestamp.call(JrubyEventExtLibrary$RubyEvent$INVOKER$i$0$0$ruby_timestamp.gen)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:134)", "org.jruby.ast.CallNoArgNode.interpret(CallNoArgNode.java:60)", "org.jruby.ast.CallNoArgNode.interpret(CallNoArgNode.java:60)", "org.jruby.ast.AttrAssignTwoArgNode.interpret(AttrAssignTwoArgNode.java:36)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.IfNode.interpret(IfNode.java:116)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.ast.BlockNode.interpret(BlockNode.java:71)", "org.jruby.ast.RescueNode.executeBody(RescueNode.java:221)", "org.jruby.ast.RescueNode.interpret(RescueNode.java:116)", "org.jruby.ast.BeginNode.interpret(BeginNode.java:83)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:74)", "org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)", "org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:203)", "org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)", "org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)", "org.jruby.ast.FCallOneArgNode.interpret(FCallOneArgNode.java:36)", "org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)", "org.jruby.evaluator.ASTInterpreter.INTERPRET_BLOCK(ASTInterpreter.java:112)", "org.jruby.runtime.Interpreted19Block.evalBlockBody(Interpreted19Block.java:206)", "org.jruby.runtime.Interpreted19Block.yield(Int