logStash错误：管道错误{：pipeline_id =＆gt; main＆quort＆quort＆quort＆quort＆quort：exception =＆gt;＃＆lt; grok :: patternerror：patternerror：pattern％{jobname：project}未定义＆gt; ,,

Question

您的文本Logstash 不断崩溃，我不确定问题是什么

完整日志： [2022-03-30T18:21:34,633][INFO][logstash.agent] 成功启动 Logstash API 端点 {:port=>9600, :ssl_enabled=>false} [2022-03-30T18:21:37,520][INFO][org.reflections.Reflections] 反射花了 167 毫秒扫描 1 个 URL，生成 119 个键和 417 个值 [2022-03-30T18:21:39,677][INFO ][logstash.outputs.elasticsearch][main] 新的 Elasticsearch 输出 {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>[" http://104.154.51.160:9200"]} [2022-03-30T18:21:40,456][INFO ][logstash.outputs.elasticsearch][main] Elasticsearch 池 URL 已更新 {:changes=>{:removed=>[], :added=>[http //104.154.51.160:9200/]}} [2022-03-30T18:21:40,912][警告][logstash.outputs.elasticsearch][main]已恢复与 ES 实例的连接 {:url=>"http://104.154.51.160:9200/"} [2022-03-30T18:21:40,944][INFO ][logstash.outputs.elasticsearch][main] Elasticsearch 版本已确定 (7.17.1) {:es_version=>7} [2022-03-30T18:21:40,957][警告][logstash.outputs.elasticsearch][main] 检测到 6.x 及更高版本集群：type 事件字段将不会用于确定文档_type {:es_version=>7} [2022-03-30T18:21:41,089][INFO][logstash.outputs.elasticsearch][main] 配置与数据流不兼容。 data_stream =>; auto 解析为 false [2022-03-30T18:21:41,094][INFO][logstash.outputs.elasticsearch][main] 配置与数据流不兼容。 data_stream =>; auto 解析为 false [2022-03-30T18:21:41,209][INFO ][logstash.outputs.elasticsearch][main] 使用默认映射模板 {:es_version=>7, :ecs_compatibility=>:disabled} [2022-03-30T18：21：41,559][错误][logstash.javapipeline][main]管道错误{：pipeline_id =＆gt;“main”，：exception =＆gt;＃＆lt;Grok :: PatternError：模式％{ JOBNAME:项目}未定义>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:123:in 块编译'", "org/jruby/RubyKernel.java:1442:in循环'", “/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/jls-grok-0.11.5/lib/grok-pure.rb:93:in 编译”， “/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.4.1/lib/logstash/filters/grok.rb:282:in寄存器中的块'", "org/jruby/RubyArray.java:1821:in each'", “/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.4.1/lib/logstash/filters/grok.rb:276:in寄存器中的块'", "org/jruby/RubyHash.java:1415:in each'", “/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-filter-grok-4.4.1/lib/logstash/filters/grok.rb:271:in注册” , "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:75:in 注册'", “/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:232:inblock in register_plugins'”，“org/jruby/RubyArray.java:1821:in each” ”，“/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:231:inregister_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:590:in maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/ lib/logstash/java_pipeline.rb:244:instart_workers'", “/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:189:in run'”，“/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb: 141:在开始'"]的块中， "pipeline.sources"=>["/etc/logstash/conf.d/jenkins.conf"], :thread=>"#"} [2022-03-30T18:21:41,570][INFO ][logstash.javapipeline][main] 管道终止 {"pipeline.id"=>"main"} [2022-03-30T18:21:41,597][错误][logstash.agent] 无法执行操作 {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=> “无法执行操作：PipelineAction::Create

，action_result: false", :backtrace=>nil} [2022-03-30T18:21:41,780][信息][logstash.runner]Logstash 关闭。 [2022-03-30T18:21:41,801][致命][org.logstash.Logstash] Logstash 由于错误而停止处理：(SystemExit) 退出 org.jruby.exceptions.SystemExit：（SystemExit）退出 在 org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.20.1.jar:?] 在 org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.20.1.jar:?] 在 usr.share.logstash.lib.bootstrap.environment.

(/usr/share/logstash/lib/bootstrap/environment.rb:94) ~[?:?]

我的conf文件

`input {
节拍{
端口=> 5000
类型=>詹金斯
}
}

过滤器 {
if [类型] == “詹金斯” {
格洛克{
模式_目录=> [“/etc/logstash/patterns”]
匹配=> {
“消息”=> "%{TIMESTAMP_ISO8601:createdAt}%{SPACE}[id=%{INT:buildId}]%{SPACE}%{LOGLEVEL:level}%{SPACE}%{JAVACLASS:class}%{DATA:state}:%{空间}%{JOBNAME:项目} #%{NUMBER:buildNumber} %{DATA:execution}: %{WORD:status}"
}
}
}
}

输出 {
if [类型] == “詹金斯” {
弹性搜索 {
主机=> 'elasticsearch 服务器 IP 位于此处'
索引 => '詹金斯-%{+YYYY.MM.dd}'
}
}
}
` 我以为它没有看到我的conf文件，但后来这一行出现在引用它的日志中： "pipeline.sources"=>["/etc/logstash/conf.d/jenkins.conf"], :thread=>"#"}

我很困惑，请帮忙！