Dead Letter Queue problem

[kernelpanic (FreeBSD user)]

Hello, I've attempted to add the dead letter queue to my configuration but when I restart logstash it fails to come back up, I've no doubt its something I'm doing wrong, hereis my relevant config:

###-INPUT-###
dead_letter_queue {
    path => "/usr/local/logstash/data/dead_letter_queue/" 
    type => deadletter
  }

###-FILTER-###

if [type] == "deadletter" {
   filter {
     mutate {
      remove_field => ["src_ip"] 
     }
   }
  }

###-OUTPUT-###

else if [type] == "deadletter" {
   elasticsearch {
    hosts => ["192.168.56.226:9200", "192.168.52.251:9200", "192.168.52.252:9200"]
    index => ["syslogcisco-%{+YYYY.MM.dd}"]
   }
  }

When I attempt to restart logstash I get the following error in the logstash log:

:backtrace=>["/usr/local/logstash/logstash-core/lib/logstash/pipeline.rb:60:ininitialize'", "/usr/local/logstash/logstash-core/lib/logstash/pipeline.rb:165:in initialize'", "/usr/local/logstash/logstash-core/lib/logstash/agent.rb:296:increate_pipeline'", "/usr/local/logstash/logstash-core/lib/logstash/agent.rb:95:in register_pipeline'", "/usr/local/logstash/logstash-core/lib/logstash/runner.rb:313:inexecute'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:in run'", "/usr/local/logstash/logstash-core/lib/logstash/runner.rb:204:inrun'", "/usr/local/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:in run'", "/usr/local/logstash/lib/bootstrap/environment.rb:71:in(root)'"]}`

I can get logstash to start properly only when I comment out the deadletter filter section.

Any help appreciated.

[yaauie (Ry Biesemeyer)]

Can you copy the whole error message? The line in the backtrace indicates that the config failed to parse, and it should give a more helpful reason.

[kernelpanic (FreeBSD user)]

Thanks for getting back to me, its quite a large error message and exceeds the 7000 character limit on this forum; the best I could think of doing was to upload a screenshot of the error to this post.