Configtest Ok if started as process, fails if started as service

[xupete]

First, I am new to Elastissearch and Logstash.

I am trying to run an example. Elasticsearch and Kibana start as services when my Ubuntu 14.04 starts, but Logstash fails. Seems a problem when Logstash is started as service and try to parse the configuration file.

ubuntu@ubuntu:/etc/logstash/conf.d$ /opt/logstash/bin/logstash agent --configtest -f twitter_search.conf
Configuration OK
ubuntu@ubuntu:/etc/logstash/conf.d$ sudo service logstash configtest
Error: Expected one of #, input, filter, output at line 28, column 1 (byte 730) after {:level=>:error}

If I start Logstash as a normal process everything runs okey, but as service (with "sudo service logstash start") Logstash stops and I get the same error text in the log file ("/var/log/logstash/logstash.log").

Logstash 2.2.4 has been installed from official package repository with apt-get install.

There is only one configuration file with a template file:

ubuntu@ubuntu:/etc/logstash/conf.d$ ls -l
total 8
-rw-r--r-- 1 root root 728 ago 15 13:03 twitter_search.conf
-rw-r--r-- 1 root root 1489 ago 15 13:01 twitter_template.json

Content of twitter_search.conf:

ubuntu@ubuntu:/etc/logstash/conf.d$ cat twitter_search.conf
input {
twitter {
consumer_key => "xxxxxxxxxxx"
consumer_secret => "xxxxxxxxxxx"
oauth_token => "xxxxxxxxxxx-xxxxxxxxxxx"
oauth_token_secret => "xxxxxxxxxxx"
keywords => ["test1","test2","test3"]
full_tweet => true
}
}

filter { }

output {
stdout {
codec => dots
}
elasticsearch {
hosts => ["127.0.0.1:9200"]
index => "twitter_elastic_example"
document_type => "tweets"
template => "./twitter_template.json"
template_name => "twitter_elastic_example"
template_overwrite => true
}
}

If I edit the config file and delete for example three lines ("stdout { codec => dots }") I get a similar error, changing the line number and byte position of error:

ubuntu@ubuntu:/etc/logstash/conf.d$ sudo service logstash configtest
Error: Expected one of #, input, filter, output at line 25, column 1 (byte 697) after {:level=>:error}

I assumed that there is no problem with user permissions, as Logstash seems to read contents of configuration file. I have launched "hexdump -C" with the configuration file and there are no strange characters at the end of file.

Any clue?

Thanks.

[magnusbaeck (Magnus Bäck)]

Logstash reads all files in /etc/logstash/conf.d. You need to store the JSON file elsewhere so Logstash doesn't read it.

[xupete]

You're right. I supposed Logstash reads only *.conf files

Thanks.