LogStash7安装启动问题

此时不应有 \Java\jdk1.8.0_181\bin\java

解决办法：该问题是由于jdk路径存在空格导致的，例如:C:\Program Files (x86)\Java\jdk1.8.0_181
该目录“Program Files (x86)”明显存在空格，可以选择将安装jdk的目录更换至其他目录，并且更改环境变量JAVA_HOME。

warning: ignoring JAVA_OPTS=-Xmx1024m; pass JVM parameters via LS_JAVA_OPTS" I tried adding set LS_JAVA_OPTS="-Xms1024m -Xmx1024m" in setup.bat and also -DLS_JAVA_OPTS="-Xms1024m -Xmx1024m

解决办法：该问题是由于缺少JAVA_OPTS环境变量原因，在环境变量中配置 JAVA_OPTS=-Xms1024m -Xmx1024m 即可，后面的参数可根据自己需要进行相关调整

Windows开发环境下无法读取本地文件

报错代码：

[2019-11-25T19:55:47,213][ERROR][logstash.javapipeline    ][main] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<ArgumentError: File paths must be absolute, relative path specified: �E:\logstash-7.4.2\LICENSE.txt>, :backtrace=>["E:/logstash-7.4.2/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.11/lib/logstash/inputs/file.rb:269:in `block in register'", "org/jruby/RubyArray.java:1800:in `each'", "E:/logstash-7.4.2/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.11/lib/logstash/inputs/file.rb:267:in `register'", "E:/logstash-7.4.2/logstash-core/lib/logstash/java_pipeline.rb:195:in `block in register_plugins'", "org/jruby/RubyArray.java:1800:in `each'", "E:/logstash-7.4.2/logstash-core/lib/logstash/java_pipeline.rb:194:in `register_plugins'", "E:/logstash-7.4.2/logstash-core/lib/logstash/java_pipeline.rb:296:in `start_inputs'", "E:/logstash-7.4.2/logstash-core/lib/logstash/java_pipeline.rb:252:in `start_workers'", "E:/logstash-7.4.2/logstash-core/lib/logstash/java_pipeline.rb:149:in `run'", "E:/logstash-7.4.2/logstash-core/lib/logstash/java_pipeline.rb:108:in `block in start'"], :thread=>"#<Thread:0x1f08d98 run>"}
[2019-11-25T19:55:47,238][ERROR][logstash.agent           ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}

解决办法：下面这段是正确代码，注意是单引号！！！ 斜杆用“/”

input {  
    stdin{}
    file{
        path=>'C:/Users/Administrator/Desktop/test.txt'
    }
} 

（太难了，国内外搜索了一天，原本用的就是单引号，看到网上用的都是双引号，结果....emmmmmmmm）

Windows换行符问题

LogStash默认使用的是Linux的换行符“\n”，而Windows的换行符为“\r\n”，所以输出单行信息后面会多一个“\r”

{
      "@version" => "1",
       "message" => "撒旦法\r",
    "@timestamp" => 2019-11-25T13:03:02.259Z,
          "path" => "C:/Users/Administrator/Desktop/test.txt",
          "host" => "XTZJ-1804031226"
}