Hi,
I am trying to input a csv file trought logstash but I am getting the following error message:
[root@wazuh-server logstash]# ./bin/logstash -f logstash_scan.config
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN ] 2018-10-04 09:53:41.086 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2018-10-04 09:53:42.120 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"6.4.0"}
[ERROR] 2018-10-04 09:53:43.012 [Converge PipelineAction::Create] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, input, filter, output at line 7, column 1 (byte 99) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2486:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:157:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:22:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:90:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:38:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:309:inblock in converge_state'"]}
and here is my config file:
input {
file {
path => "/usr/share/logstash/usi_scan.csv"
start_position => "beginning"
}
}
filer {
csv {
separator => ";"
colums => [ Risk;Host;Universo ]
}
}
output {
elasticsearch {
hosts => "localhost"
index => "vulns"
document_type => "find_vulns"
stdout {}
}
}
Can someone please help me?
Thank you!