Dead Letter Queue problem

Hello, I've attempted to add the dead letter queue to my configuration but when I restart logstash it fails to come back up, I've no doubt its something I'm doing wrong, hereis my relevant config:

###-INPUT-###
dead_letter_queue {
    path => "/usr/local/logstash/data/dead_letter_queue/" 
    type => deadletter
  }

###-FILTER-###

if [type] == "deadletter" {
   filter {
     mutate {
      remove_field => ["src_ip"] 
     }
   }
  }

###-OUTPUT-###

else if [type] == "deadletter" {
   elasticsearch {
    hosts => ["192.168.56.226:9200", "192.168.52.251:9200", "192.168.52.252:9200"]
    index => ["syslogcisco-%{+YYYY.MM.dd}"]
   }
  }

When I attempt to restart logstash I get the following error in the logstash log:

:backtrace=>["/usr/local/logstash/logstash-core/lib/logstash/pipeline.rb:60:ininitialize'", "/usr/local/logstash/logstash-core/lib/logstash/pipeline.rb:165:in initialize'", "/usr/local/logstash/logstash-core/lib/logstash/agent.rb:296:increate_pipeline'", "/usr/local/logstash/logstash-core/lib/logstash/agent.rb:95:in register_pipeline'", "/usr/local/logstash/logstash-core/lib/logstash/runner.rb:313:inexecute'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:in run'", "/usr/local/logstash/logstash-core/lib/logstash/runner.rb:204:inrun'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:in run'", "/usr/local/logstash/lib/bootstrap/environment.rb:71:in(root)'"]}`

I can get logstash to start properly only when I comment out the deadletter filter section.

Any help appreciated.

Can you copy the whole error message? The line in the backtrace indicates that the config failed to parse, and it should give a more helpful reason.

Thanks for getting back to me, its quite a large error message and exceeds the 7000 character limit on this forum; the best I could think of doing was to upload a screenshot of the error to this post.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.