Logstash TCP输入插件无法转发日志，请求故障排查

本地运行Elasticsearch(8.10.2)、Logstash、Kibana及应用容器，应用原本通过UDP 9600端口向Logstash转发日志，切换为TCP后出现异常：Elasticsearch生成了目标索引但无数据写入，同时Logstash容器抛出参数错误。

现有配置 #

1. logstash.conf #

input {
  tcp {
    port => 9600
  }
}
output {
  elasticsearch { 
    hosts => ["http://elasticsearch:9200"]
    index => "titan-%{+YYYY-MM-dd}"
    ilm_enabled => "true"
    ilm_rollover_alias => "myapp"
    ilm_pattern => "{now/d}-000001"
    ilm_policy => "myapp-policy"
    user => "elastic"
    password => <elastic-password>
  }
}

2. Logstash的Docker Compose配置 #

Logstash:
  image: logstash:8.10.2
  container_name: logstash
  restart: always
  volumes:
  - ./logstash/:/logstash_dir
  command: logstash -f /logstash_dir/logstash.conf 
  depends_on:
    - Elasticsearch
  ports:
  - '9600:9600'
  environment:
    LS_JAVA_OPTS: "-Xmx512m -Xms512m"

3. 应用的Docker Compose日志配置 #

logging:
  driver: syslog
  options:
    syslog-address: "tcp://localhost:9600"

Logstash错误日志 #

warning: thread "[main]<tcp" terminated with exception (report_on_exception is true):
ArgumentError: wrong number of arguments (given 2, expected 0..1)
    translate at /usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/i18n-1.14.1/lib/i18n.rb:210
  inputworker at /usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:427
  start_input at /usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:405

问题原因与修复方案 #

1. TCP输入缺失syslog codec配置
   Logstash的TCP输入默认不解析syslog格式数据，而应用通过syslog驱动发送日志，导致Logstash无法处理输入内容，触发参数错误。需在TCP输入中指定syslog编解码器：
   修改logstash.conf的input部分：

   input {
     tcp {
       port => 9600
       codec => syslog
     }
   }
   

2. Docker容器间网络访问错误
   应用容器内使用localhost:9600访问Logstash，在Docker Compose环境下，容器间需通过服务名通信，应改为logstash:9600，否则应用无法连接到Logstash容器：
   修改应用的Docker Compose日志配置：

   logging:
     driver: syslog
     options:
       syslog-address: "tcp://logstash:9600"
   

3. ILM策略验证（可选）
   确保Elasticsearch中已创建myapp-policy索引生命周期策略，否则ILM配置会导致数据无法写入索引。可在Kibana的索引生命周期管理模块中检查或创建该策略。

内容的提问来源于stack exchange，提问作者sne