Creating pipeline for windows using logstash

Elastic Stack Logstash
1

i have written the following code for ingesting the files into elastic search
/*input{
file{
path=>"D:\SOATE-41\project\DOCUMENTATION\interim\datacsv.csv"
start_position=>"beginning"
sincedb_path=>"/dev/null"
}
}
filter{
csv{
seperator=>","
columns=>["iyear""imonth""iday""Country""State""City""latitude""longitude""location""summary""Type of Activity""attacktype1_txt""type of target""targsubtype1_txt""Security Forces""Target""Tanzeem""Motive""Wpn type""Wpn Details""weapdetail""total killed""Own Killed""trts cas""Remarks""Source""scite2""scite3"]
}
output{
elasticsearch{
host=>"localhost"
index=>"ciactivities"
document_type=>"sitreps"
}
stdout{}
} */

I AM RECEIVING THE FOLLOWING ERROR
Thread.exclusive is deprecated, use Thread::Mutex
Sending Logstash logs to C:/logstash-7.5.2/logs which is now configured via log4j2.properties
[2020-02-04T11:20:43,318][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2020-02-04T11:20:43,520][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.5.2"}
[2020-02-04T11:20:45,195][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [ \t\r\n], "#", "{", ",", "]" at line 11, column 18 (byte 189) after filter{\r\ncsv{\r\nseperator=>","\r\ncolumns=>["iyear"", :backtrace=>["C:/logstash-7.5.2/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "C:/logstash-7.5.2/logstash-core/lib/logstash/compiler.rb:49:in compile_graph'", "C:/logstash-7.5.2/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2584:in map'", "C:/logstash-7.5.2/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:156:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "C:/logstash-7.5.2/logstash-core/lib/logstash/java_pipeline.rb:27:in initialize'", "C:/logstash-7.5.2/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "C:/logstash-7.5.2/logstash-core/lib/logstash/agent.rb:326:in block in converge_state'"]}
[2020-02-04T11:20:45,794][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2020-02-04T11:20:50,648][INFO ][logstash.runner ] Logstash shut down.

2

Column names should be comma separated. Also, do not use backslash in the path option of a file input, change them to forward slash.

3

thanks badger for your reply could ingest my intended files.........will connect further for issues related to elk

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.