Cannot Monitor Logstash

Elastic Stack Logstash
#1

Hi,

Logstash is not showing in the Monitor Tab of Kibana. Only Elasicsearch and Kibana is showing.

image.png1283×538 41.3 KB

I have configured mypipeline.conf

input { stdin { }}
output {
  elasticsearch { hosts => ["CTLSQL12WPPOC:9200"] }
  stdout { codec => rubydebug }
}

This is my logstash.yml

xpack.monitoring.elasticsearch.url: [ "http://CTLSQL12WPPOC:9200", "http://CTLWIN12SM1:9200" ]
xpack.monitoring.elasticsearch.username: "logstash_system" 
xpack.monitoring.elasticsearch.password: "changeme"

Please advise on what is lacking. Thanks!

#2

Have you installed the X-Pack plugin in Logstash?

#3

Yes, I have installed X-PACK on both servers. Thanks!

#4

Hi Christian,

Is there a missing configuration? Thanks!

#5

That looks correct as far as I can see. Can you run bin/logstash-plugin list to verify that the x-pack plugin was installed successfully? Is there anything in the Logstash logs?

#6

Hi,

Upon checking, there is no monitoring-logstash created.

image.png743×160 28.3 KB

I have also checked the list of plugins for logstash and x-pack is included.

#7

Is Logstash running? Is it processing any data?

#8

Hi Christian,

I have changed my conf file.

input {
  beats {
    port => 5044
  },
  user => logstash_internal
  password => changeme
}

output {
  elasticsearch {
    hosts => "CTLSQL12WPPOC:9200"
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  },
  user => logstash_internal
  password => changeme
}

In the services, logstash is running.

image.png860×25 1.96 KB

#9

These sections are not in the right place. It should be within the elastic search block.

#10

Hi,

How about this.

input { stdin {},
  user => logstash_internal
  password => changeme
}
output {
  elasticsearch { hosts => ["CTLSQL12WPPOC:9200"] 
  user => logstash_internal
  password => changeme
}
  stdout { codec => rubydebug }
}
#11

Why do you have a user and password in the input block? If Logstash is running, you should be able to curl its monitoring API on port 9600 to verify that it is up and running.

#12

Hi Christian,

When I run the conf this is the output.

Also, this is my new conf file since you mentioned that it doesn't need user and pw.

input { stdin { }}
output {
  elasticsearch { hosts => ["CTLSQL12WPPOC:9200"] }
  stdout { codec => rubydebug }
}
#13

Please do not post images of text as it can be hard to read.

#14

Hi,

It stating bad URI if i run bin/logstash -f mypipeline.conf

Thanks!

1 Like
#15

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.