无法将日志从rsyslog发送到logstash和elasticsearch

Question

我使用的是 ubuntu，并且在同一台机器上安装了 ELK stack 版本 8.5。我对每个服务（logstash、elasticsearch、kibana）进行了必要的配置，并且同样配置了 rsyslog 以将日志发送到logstash（定义每天创建的索引）以及从logstash 发送到elasticsearch。问题是，当 rsyslog 在logstash中输入时，我在elasticsearch中看不到任何日志，同时当我将文件输入与文件路径一起使用时，它可以工作（我也可以在elasticsearch和kibana中看到索引），但我也意识到某些文件不显示。因此它适用于某些文件，但不适用于其他文件。那可能是什么问题呢？

rsyslog.conf 文件

#################
#### MODULES ####
#################

module(load="imuxsock") # provides support for local system logging
#module(load="immark")  # provides --MARK-- message capability

# provides UDP syslog reception
module(load="imudp")
input(type="imudp" port="514")

# provides TCP syslog reception
module(load="imtcp")
input(type="imtcp" port="514")

# provides kernel logging support and enable non-kernel klog messages
module(load="imklog" permitnonkernelfacility="on")

/etc/rsyslog.d目录中的配置文件

01-json-template.conf file

    template(name="json-template"
  type="list") {
    constant(value="{")
      constant(value="\"@timestamp\":\"")     property(name="timereported" dateFormat="rfc3339")
      constant(value="\",\"@version\":\"1")
      constant(value="\",\"message\":\"")     property(name="msg" format="json")
      constant(value="\",\"sysloghost\":\"")  property(name="hostname")
      constant(value="\",\"severity\":\"")    property(name="syslogseverity-text")
      constant(value="\",\"facility\":\"")    property(name="syslogfacility-text")
      constant(value="\",\"programname\":\"") property(name="programname")
      constant(value="\",\"procid\":\"")      property(name="procid")
    constant(value="\"}\n")
}

50-default.conf 文件

    #  Default rules for rsyslog.
#
#                       For more information see rsyslog.conf(5) and /etc/rsyslog.conf

*.*                                                     @localhost:514

#
# First some standard log files.  Log by facility.
#
auth,authpriv.*                 /var/log/auth.log
*.*;auth,authpriv.none          -/var/log/syslog
#cron.*                         /var/log/cron.log
#daemon.*                       -/var/log/daemon.log
kern.*                          -/var/log/kern.log
#lpr.*                          -/var/log/lpr.log
mail.*                          -/var/log/mail.log
#user.*                         -/var/log/user.log

#
# Logging for the mail system.  Split it up so that
# it is easy to write scripts to parse these files.
#
#mail.info                      -/var/log/mail.info
#mail.warn                      -/var/log/mail.warn
mail.err                        /var/log/mail.err

60-output.conf 文件

    # This line sends all lines to defined IP address at port 10514,
# using the "json-template" format template

*.*                                             @localhost:10514;json-template

rsyslog 的logstash 配置文件

    input {
  udp {
    host => "localhost"
    port => 10514
    codec => "json"
    type => "rsyslog"
  }
}


    output {
    elasticsearch {
      hosts => ["localhost:9200"]
      index => "rsyslog-%{+YYYY.MM.dd}"
  }
}