Bad Password Characters in Logstash Config file

[ccampbell]

In testing out a Windows Eventlog collection system using the Elastic stack, I discovered a curious problem with the password I was using for connecting through Xpack. I had used a system generated password that used several dashes ( - ) in the password, which Logstash refused to parse, saying that I was missing a closing brace at that line.

It took me a while to discover that this was the problem, since the Xpack passwords for my Kibana and Elastic installs also have dashes in them and had no problems (but they're parsed in the .yml file, NOT the config file). Putting quotes around the password allows the config file to be fully parsed, but the password is presented WITH the quotes, so it generates a bad password error when connecting to Elastic.

I'm curious if anyone else has seen this problem, and if there's a list of unparsable characters for the Logstash configuration file?

[magnusbaeck (Magnus Bäck)]

Did you double-quote the string in the config file, i.e.

password => "secret-stuff"

rather than

password => secret-stuff

?

[ccampbell]

Yes, double quotes allowed the configuration file to parse correctly. I should amend my topic - I was getting a 403 error that I thought was a bad password result (due to the quotes) but was actually a bad_permission error.

So yes, double quotes appears to be the way around special characters in a password. Is that documented anywhere?

I should add that this is on a Windows Server (2012 R2) install.

[magnusbaeck (Magnus Bäck)]

So yes, double quotes appears to be the way around special characters in a password. Is that documented anywhere?

All kinds of strings, passwords or not, should be quoted. The fact that single-word bare tokens are also accepted as string literals is a design mistake.

Quoting Structure of a pipeline | Logstash Reference [8.11] | Elastic

A string must be a single character sequence. Note that string values are enclosed in quotes, either double or single. Literal quotes in the string need to be escaped with a backslash if they are of the same kind as the string delimiter, i.e. single quotes within a single-quoted string need to be escaped as well as double quotes within a double-quoted string.