input {
beats {
port => 5044
}
}
filter {
if [message] =~ /Error/ {
grok {
match => { "message" => ["(?:Error:(?<error_exception>.*))"] }
}
mutate {
add_field => { "[@metadata][zabbix_host_error]" => "%{[fields][hostname]}" }
add_field => { "[@metadata][zabbix_key_error]" => "gate_error" }
add_field => { "[@metadata][zabbix_msg_error]" => "%{message}" }
}
}
}
output {
stdout { codec => rubydebug }
} if [message] =~ /Error/ {
elasticsearch {
hosts => ["elasticsearch:9200"]
user => "logstash_internal"
password => "${LOGSTASH_INTERNAL_PASSWORD}"
index => "error-%{+yyyy.MM.dd}"
}
zabbix {
zabbix_host => "[@metadata][zabbix_host_error]"
zabbix_server_host => "my_IP"
zabbix_server_port => my_port
zabbix_key => "[@metadata][zabbix_key_error]"
zabbix_value => "[@metadata][zabbix_msg_error]"
}
}[FATAL][org.logstash.Logstash ] Logstash stopped processing
Я видимо ошибочно предположил, что у SYSTEM по умолчанию есть SeRemoteShutdownPrivilege