Can't run logstash. pathname contains null byte

Elastic Stack Logstash
1

I'm trying to run logstash for elasticsearch but getting this error. I don't know what is the reason. Please help me.

    [ERROR] 2020-06-14 01:17:31.633 [[main]-pipeline-manager] javapipeline - Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<ArgumentError: pathname contains null byte>, :backtrace=>["org/jruby/ext/pathname/RubyPathname.java:197:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.16/lib/logstash/inputs/file.rb:274:in `block in register'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.16/lib/logstash/inputs/file.rb:273:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:216:in `block in register_plugins'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:215:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:327:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:287:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:170:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:125:in `block in start'"], "pipeline.sources"=>["/usr/share/logstash/bin/logstash.conf"], :thread=>"#<Thread:0x79aee194 run>"}
	[ERROR] 2020-06-14 01:17:31.667 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}

here is my configuration file:

	input {
		file {
			path => "/home/rsa-key-20200528/aslogger.log"
			type => "apache"
			start_position => "beginning"
		}
	}
	
	output {
		stdout {
			codec => rubydebug
		}
		elasticsearch {
			hosts => ["exaple_host:9200"]
			index => "aslogger"
		}
	}

here is sample of my log:

	109.169.248.247 - - [12/Dec/2015:18:25:11 +0100] "POST /administrator/index.php HTTP/1.1" 200 4494 "http://almhuette-raith.at/administrator/" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" "-"
	46.72.177.4 - - [12/Dec/2015:18:31:08 +0100] "GET /administrator/ HTTP/1.1" 200 4263 "-" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" "-"
	46.72.177.4 - - [12/Dec/2015:18:31:08 +0100] "POST /administrator/index.php HTTP/1.1" 200 4494 "http://almhuette-raith.at/administrator/" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" "-"
	83.167.113.100 - - [12/Dec/2015:18:31:25 +0100] "GET /administrator/ HTTP/1.1" 200 4263 "-" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" "-"
	83.167.113.100 - - [12/Dec/2015:18:31:25 +0100] "POST /administrator/index.php HTTP/1.1" 200 4494 "http://almhuette-raith.at/administrator/" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" "-"
	95.29.198.15 - - [12/Dec/2015:18:32:10 +0100] "GET /administrator/ HTTP/1.1" 200 4263 "-" "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" "-"
2

how did you run logstash? systemctl? of cli?

3

systemctl

4

you will need to show your logstash.yml, pipelines.yml. also, in which directory is your config file located?

5

Sorry for late reply. Here is the my run command:
sudo ./logstash -f /usr/share/logstash/bin/logstash.conf

6

I didn't do anything with pipelines.yml

7

i’m confused. you said before you’re running with systemctl, now you run it with cli.

what’s the output of the above command ?

8

Sorry, first time I did mistake. Second time I just copy-paste from my command line. Help me according to this command:
sudo ./logstash -f /usr/share/logstash/bin/logstash.conf

What is the wrong? What should I do?

9

I'm a beginner in elasticsearch. I just know about basic things. Help me

10

run this command and share the errors that you encountered

11

I did run this command and I shared those two error in my topic.

12

and this is the content of /usr/share/logstash/bin/logstash.conf ? that’s strange because logstash is complaining that that file is null-byte . have you tried using other config? it will be good if you can show the whole error message after you run the comand

13

Yes, I also though it is strange. So that I checked the file size in server. That is 239 bytes. I also download that file and saw everything is ok. Anyway here is the full error. It is too big:

WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN ] 2020-06-14 06:22:00.675 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2020-06-14 06:22:00.700 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"7.7.1"}
[INFO ] 2020-06-14 06:22:04.341 [Converge PipelineAction::Create<main>] Reflections - Reflections took 103 ms to scan 1 urls, producing 21 keys and 41 values 
[INFO ] 2020-06-14 06:22:08.165 [[main]-pipeline-manager] elasticsearch - Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[http://34.82.215.36:9200/]}}
[WARN ] 2020-06-14 06:22:08.696 [[main]-pipeline-manager] elasticsearch - Restored connection to ES instance {:url=>"http://34.82.215.36:9200/"}
[INFO ] 2020-06-14 06:22:09.133 [[main]-pipeline-manager] elasticsearch - ES Output version determined {:es_version=>7}
[WARN ] 2020-06-14 06:22:09.142 [[main]-pipeline-manager] elasticsearch - Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[INFO ] 2020-06-14 06:22:09.249 [[main]-pipeline-manager] elasticsearch - New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["//34.82.215.36:9200"]}
[INFO ] 2020-06-14 06:22:09.411 [Ruby-0-Thread-6: :1] elasticsearch - Using default mapping template
[INFO ] 2020-06-14 06:22:09.514 [Ruby-0-Thread-6: :1] elasticsearch - Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[WARN ] 2020-06-14 06:22:09.558 [[main]-pipeline-manager] LazyDelegatingGauge - A gauge metric of an unknown type (org.jruby.specialized.RubyArrayOneObject) has been created for key: cluster_uuids. This may result in invalid serialization.  It is recommended to log an issue to the responsible developer/development team.
[INFO ] 2020-06-14 06:22:09.573 [[main]-pipeline-manager] javapipeline - Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>1, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50, "pipeline.max_inflight"=>125, "pipeline.sources"=>["/usr/share/logstash/bin/logstash.conf"], :thread=>"#<Thread:0x5603a28f run>"}
[ERROR] 2020-06-14 06:22:12.266 [[main]-pipeline-manager] javapipeline - Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<ArgumentError: pathname contains null byte>, :backtrace=>["org/jruby/ext/pathname/RubyPathname.java:197:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.16/lib/logstash/inputs/file.rb:274:in `block in register'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-input-file-4.1.16/lib/logstash/inputs/file.rb:273:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:216:in `block in register_plugins'", "org/jruby/RubyArray.java:1809:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:215:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:327:in `start_inputs'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:287:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:170:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:125:in `block in start'"], "pipeline.sources"=>["/usr/share/logstash/bin/logstash.conf"], :thread=>"#<Thread:0x5603a28f run>"}
[ERROR] 2020-06-14 06:22:12.304 [Converge PipelineAction::Create<main>] agent - Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}
[INFO ] 2020-06-14 06:22:12.935 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[INFO ] 2020-06-14 06:22:17.690 [LogStash::Runner] runner - Logstash shutdownn.
14

A nice guy from stackoverflow solved my problem. The main problem was my motherfu***r FTP clients software. Everytime this software change my path location with some unwanted "@".

I upload this:

	path => "/home/rsa-key-20200528/aslogger.log"

and this software convert into this:

	path => "/home/rsa-key-20200528^@^@^@^@^@^@/*.log"

it ruined my configuration just putting some "@". Then I check the file according to his answer and edit this line with nano. Now everything is fine.
Also I want to say thank you too. Although it is very hard to guise the problem is happening for FTP clients but your try to help me. thanks for that❤

15

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.