2018年4月25日 星期三
10:11
現(xiàn)象
Logstash使用webhdfs插件桑滩，配置完成后無法正常輸出到HDFS中称簿，日志中報錯：
[2018-04-25T00:00:26,915][WARN ][logstash.outputs.webhdfs ] Failed to flush outgoing items {:outgoing_count=>1, :exception=>"WebHDFS::ServerError", :backtrace=>["/opt/logstash-6.2.4/vendor/bundle/jruby/2.3.0/gems/webhdfs-0.8.0/lib/webhdfs/client_v1.rb:351:in `request'", "/opt/logstash-6.2.4/vendor/bundle/jruby/2.3.0/gems/webhdfs-0.8.0/lib/webhdfs/client_v1.rb:270:in `operate_requests'", "/opt/logstash-6.2.4/vendor/bundle/jruby/2.3.0/gems/webhdfs-0.8.0/lib/webhdfs/client_v1.rb:73:in `create'", "/opt/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-webhdfs-3.0.6/lib/logstash/outputs/webhdfs.rb:228:in `write_data'", "/opt/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-webhdfs-3.0.6/lib/logstash/outputs/webhdfs.rb:211:in `block in flush'", "org/jruby/RubyHash.java:1343:in `each'", "/opt/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-webhdfs-3.0.6/lib/logstash/outputs/webhdfs.rb:199:in `flush'", "/opt/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/buffer.rb:219:in `block in buffer_flush'", "org/jruby/RubyHash.java:1343:in `each'", "/opt/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/buffer.rb:216:in `buffer_flush'", "/opt/logstash/vendor/bundle/jruby/2.3.0/gems/stud-0.0.23/lib/stud/buffer.rb:159:in `buffer_receive'", "/opt/logstash/vendor/bundle/jruby/2.3.0/gems/logstash-output-webhdfs-3.0.6/lib/logstash/outputs/webhdfs.rb:182:in `receive'", "/opt/logstash/logstash-core/lib/logstash/outputs/base.rb:92:in `block in multi_receive'", "org/jruby/RubyArray.java:1734:in `each'", "/opt/logstash/logstash-core/lib/logstash/outputs/base.rb:92:in `multi_receive'", "/opt/logstash/logstash-core/lib/logstash/output_delegator_strategies/legacy.rb:22:in `multi_receive'", "/opt/logstash/logstash-core/lib/logstash/output_delegator.rb:49:in `multi_receive'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:477:in `block in output_batch'", "org/jruby/RubyHash.java:1343:in `each'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:476:in `output_batch'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:428:in `worker_loop'", "/opt/logstash/logstash-core/lib/logstash/pipeline.rb:386:in `block in start_workers'"]}
分析
檢查配置
既然報這個錯誤随静，就確定是訪問WebHDFS過程中出錯茅特，那么首先檢查下配置哆料。
配置內(nèi)容如下：
input {
beats {
port => "5044"
}
}
output {
stdout{
codec => rubydebug
}
webhdfs {
host => "x.x.x.x"
port => 9870
path => "/weblog/iis/%{@source_host}/%{+YYYY-MM-dd}/iislog-%{@source_host}-%{YYYYMMddHH}.log"
user => "root"
retry_times => 100
}
}
WebHDFS: ServerError
因為沒用過Logstash，但是直到很簡單易用策添。所以直接搜關(guān)鍵字材部，查找到了logstash-output-webhdfs Failed to flush outgoing items這篇文章，提到：
It seems you should set user option of logstash-output-webhdfs to the hdfs supergroup user,which is the user you use to start hdfs.For example ,if you use root to run start-dfs.sh bash,then the user option shuold be root.
In addition, you should edit /etc/hosts ,add the hdfs cluster node route list .
可以確認兩點常見問題：
- HDFS訪問賬戶問題唯竹；
- HDFS的主機解析問題乐导；
解決
HDFS訪問賬戶問題
這個很容易確認，HDFS上使用的賬戶就是root浸颓。
HDFS主機解析問題
查看/etc/hosts內(nèi)容物臂，發(fā)現(xiàn)只有namenode做了配置。
簡單思考了下产上，Logstash默認可能使用主機名進行解析的棵磷，而且從namenode獲取到的也應(yīng)該是主機名。因此Answer中才說要加入節(jié)點路由列表晋涣。
增加hosts
直接將所有Hadoop的節(jié)點/IP映射放入/etc/hosts中仪媒。
修改配置
然后修改logstash配置。
input {
beats {
port => "5044"
}
}
output {
stdout{
codec => rubydebug
}
webhdfs {
host => "namenode"
port => 9870
path => "/weblog/iis/%{+YYYY-MM-dd}/%{@source_host}/iislog-%{+HH}.log"
user => "root"
retry_times => 100
}
}
確認結(jié)果
查看HDFS中谢鹊，如果有建立對應(yīng)目錄和文件就OK了算吩。
遺留問題
實際上還存在一些問題：
- 按照官網(wǎng)示例，年月日前面有個
dt=不明白什么作用撇贺。 -
%{@source_host}無法解析赌莺。 -
{+HH}不是按照UTC+0800來建立的冰抢。
