onebirdrocks / geektime-ELK

ELK Training
1.21k stars 2.54k forks source link

docker logstash-input-file start error "cannot unmarshal !!str `input {...` into map[string]interface {}" #22

Open EverSpring opened 4 years ago

EverSpring commented 4 years ago

Hi: docker version: 19.03.13 logstash version: 7.4.0 run command: docker run -d --name logstash-test -v /home/docker/logstash.conf:/usr/share/logstash/config/logstash.yml logstash:7.4.0 logstash.yml: ` input { file { path => "/home/docker/movies.csv" start_position => "beginning" sincedb_path => "/dev/null" } } filter { csv { separator => "," columns => ["id","content","genre"] }

mutate { split => { "genre" => "|" } remove_field => ["path", "host","@timestamp","message"] }

mutate {

split => ["content", "("]
add_field => { "title" => "%{[content][0]}"}
add_field => { "year" => "%{[content][1]}"}

}

mutate { convert => { "year" => "integer" } strip => ["title"] remove_field => ["path", "host","@timestamp","message","content"] }

} output { elasticsearch { hosts => "http://es-cluster:9200" index => "movies" document_id => "%{id}" user => "es" password => "pwd" } stdout {} } **report error**: cannot unmarshal !!str input {... into map[string]interface {}`

Can you help me to fix it ,thanks

koskoskos commented 1 year ago

Hi: docker version: 19.03.13 logstash version: 7.4.0 run command: docker run -d --name logstash-test -v /home/docker/logstash.conf:/usr/share/logstash/config/logstash.yml logstash:7.4.0 logstash.yml: ` input { file { path => "/home/docker/movies.csv" start_position => "beginning" sincedb_path => "/dev/null" } } filter { csv { separator => "," columns => ["id","content","genre"] }

mutate { split => { "genre" => "|" } remove_field => ["path", "host","@timestamp","message"] }

mutate {

split => ["content", "("]
add_field => { "title" => "%{[content][0]}"}
add_field => { "year" => "%{[content][1]}"}

}

mutate { convert => { "year" => "integer" } strip => ["title"] remove_field => ["path", "host","@timestamp","message","content"] }

} output { elasticsearch { hosts => "http://es-cluster:9200" index => "movies" document_id => "%{id}" user => "es" password => "pwd" } stdout {} } **report error**:cannot unmarshal !!str input {... into map[string]interface {}`

Can you help me to fix it ,thanks

Did you solve this problem?