[ERROR] [logstash.agent] Failed to execute action

nml1988 · May 29, 2023, 1:14pm

Hello! I need help from the community!
I am having a failure during the execution of the logstash ingest pipes.

The service starts normally, but when executing the different pipelines I see this error for which I can't find information. From what I could see it is not a problem of permissions, connection or structure of the YAML itself, so I can't find where to continue checking.

The output of the ingest pipe is as follows:

output {
  elasticsearch {
    hosts => ["hosts"]
    pipeline => "combo"
    user => "user"
    password => "pass"
    ssl => true 
    cacert => "/path/to/ca.crt"
    index => "oci-dc"
  }
#stdout {}
}

Thank you very much for your help

leandrojmp · May 29, 2023, 1:57pm

This error normally happens when logstash cannot create your pipeline because of some issue in the configuration.

Please share your entire pipeline configuration for the pipeline with the id oci_br.

Also, share your pipelines.yml as well.

nml1988 · May 29, 2023, 2:47pm

Thank you very much for the reply!
I have attached the information you requested.

Logstash version: 7.9.2

oci_dc (like oci_br):

input {
  file {
    path => "/u01/testdir/ApiOci/oci-dc/oci-reproceso/report/*.json"
    start_position => "beginning"
    sincedb_path => "/dev/null"
    codec => json
  }
}

filter {
  ## Rename Campos
  if [lineItem/referenceNo] { mutate {rename => { "lineItem/referenceNo" => "ReferenceNo" } } }
  if [lineItem/tenantId] { mutate {rename => { "lineItem/tenantId" => "TenantId" } } }
  if [lineItem/intervalUsageStart] { mutate {rename => { "lineItem/intervalUsageStart" => "lineItem_intervalUsageStart" } } }
  if [lineItem/intervalUsageEnd] { mutate {rename => { "lineItem/intervalUsageEnd" => "lineItem_intervalUsageEnd" } } }
  if [product/service] { mutate {rename => { "product/service" => "Service" } } }
  if [product/compartmentId] { mutate {rename => { "product/compartmentId" => "CompartmentId" } } }
  if [product/compartmentName] { mutate {rename => { "product/compartmentName" => "CompartmentName" } } }
  if [product/region] { mutate {rename => { "product/region" => "Region" } } }
  if [product/availabilityDomain] { mutate {rename => { "product/availabilityDomain" => "AvailabilityDomain" } } }
  if [product/resourceId] { mutate {rename => { "product/resourceId" => "ResourceId" } } }
  if [usage/billedQuantity] { mutate {rename => { "usage/billedQuantity" => "Billed_Quantity_Regular" } } }
  if [usage/billedQuantityOverage] { mutate {rename => { "usage/billedQuantityOverage" => "Billed_Quantity_Overage" } } }
  if [cost/subscriptionId] { mutate {rename => { "cost/subscriptionId" => "SubscriptionId" } } }
  if [cost/productSku] { mutate {rename => { "cost/productSku" => "ProductSku" } } }
  if [product/Description] { mutate {rename => { "product/Description" => "Description" } } }
  if [cost/unitPrice] { mutate {rename => { "cost/unitPrice" => "Unit_Price_Regular" } } }
  if [cost/unitPriceOverage] { mutate {rename => { "cost/unitPriceOverage" => "Unit_Price_Overage" } } }
  if [cost/myCost] { mutate {rename => { "cost/myCost" => "Cost_Local_Regular" } } }
  if [cost/myCostOverage] { mutate {rename => { "cost/myCostOverage" => "Cost_Local_Overage" } } }
  if [cost/currencyCode] { mutate {rename => { "cost/currencyCode" => "CurrencyCode" } } }
  if [cost/billingUnitReadable] { mutate {rename => { "cost/billingUnitReadable" => "Billing_Unit_Readable" } } }
  if [cost/skuUnitDescription] { mutate {rename => { "cost/skuUnitDescription" => "SkuUnitDescription" } } }
  if [cost/overageFlag] { mutate {rename => { "cost/overageFlag" => "OverageFlag" } } }
  if [lineItem/isCorrection] { mutate {rename => { "lineItem/isCorrection" => "IsCorrection" } } }
  if [lineItem/backreferenceNo] { mutate {rename => { "lineItem/backreferenceNo" => "BackreferenceNo" } } }
  if [tags/Automation.backup_policy] { mutate {rename => { "tags/Automation.backup_policy" => "Automation_Backup_Policy" } } }
  if [tags/Automation.enddate] { mutate {rename => { "tags/Automation.enddate" => "Automation_EndDate" } } }
  if [tags/Automation.schedule] { mutate {rename => { "tags/Automation.schedule" => "Automation_Schedule" } } }
  if [tags/Automation.startdate] { mutate {rename => { "tags/Automation.startdate" => "Automation_StartDate" } } }
  if [tags/Business.adminby] { mutate {rename => { "tags/Business.adminby" => "Business_Adminby" } } }
  if [tags/Business.costcenter] { mutate {rename => { "tags/Business.costcenter" => "Business_Costcenter" } } }
  if [tags/Business.market] { mutate {rename => { "tags/Business.market" => "Business_Market" } } }
  if [tags/Business.organization] { mutate {rename => { "tags/Business.organization" => "Business_Organization" } } }
  if [tags/Business.owner] { mutate {rename => { "tags/Business.owner" => "Business_Owner" } } }
  if [tags/Business.project_id] { mutate {rename => { "tags/Business.project_id" => "Business_Project_Id" } } }
  if [tags/Business.service] { mutate {rename => { "tags/Business.service" => "Business_Service" } } }
  if [tags/Business.workload_id] { mutate {rename => { "tags/Business.workload_id" => "Business_Workload_id" } } }
  if [tags/DOC] { mutate {rename => { "tags/DOC" => "DOC" } } }
  if [tags/Name] { mutate {rename => { "tags/Name" => "Name" } } }
  if [tags/Project] { mutate {rename => { "tags/Project" => "Project" } } }
  if [tags/Purpose] { mutate {rename => { "tags/Purpose" => "Purpose" } } }
  if [tags/Security.compliance] { mutate {rename => { "tags/Security.compliance" => "Security_Compliance" } } }
  if [tags/Security.patchlevel] { mutate {rename => { "tags/Security.patchlevel" => "Security_Patchlevel" } } }
  if [tags/Security.vcn] { mutate {rename => { "tags/Security.vcn" => "Security_Patchlevel_VNC" } } }
  if [tags/Technical.application] { mutate {rename => { "tags/Technical.application" => "Technical_Application" } } }
  if [tags/Technical.cluster] { mutate {rename => { "tags/Technical.cluster" => "Technical_Cluster" } } }
  if [tags/Technical.environment] { mutate {rename => { "tags/Technical.environment" => "Technical_Environment" } } }
  if [tags/Technical.platform] { mutate {rename => { "tags/Technical.platform" => "Technical_Platform" } } }
  if [tags/Technical.requestedby] { mutate {rename => { "tags/Technical.requestedby" => "Technical_Requestedby" } } }
  if [tags/Technical.resource_name] { mutate {rename => { "tags/Technical.resource_name" => "Technical_Resource_Name" } } }
  if [tags/Technical.resource_role] { mutate {rename => { "tags/Technical.resource_role" => "Technical_Resource_Role" } } }
  if [tags/Technical.staging] { mutate {rename => { "tags/Technical.staging" => "Technical_Staging" } } }
  if [tags/Technical.ucmdb_id] { mutate {rename => { "tags/Technical.ucmdb_id" => "Technical_Ucmdb_Id" } } }
  if [tags/Technical.version] { mutate {rename => { "tags/Technical.version" => "Technical_Version" } } }
  if [tags/bds-instance] { mutate {rename => { "tags/bds-instance" => "Bds-Instance" } } }
  if [tags/mail] { mutate {rename => { "tags/mail" => "Mail" } } }
  if [tags/orcl-cloud.free-tier-retained] { mutate {rename => { "tags/orcl-cloud.free-tier-retained" => "Orcl-cloud_free-tier-retained" } } }
  if [tags/owner] { mutate {rename => { "tags/owner" => "Owner" } } }
  if [tags/purpose] { mutate {rename => { "tags/purpose" => "Purpose2" } } }
  if [tags/test] { mutate {rename => { "tags/test" => "Test" } } }
  if [tags/type] { mutate {rename => { "tags/type" => "Type" } } }

  ## Remove null fields
  if [ReferenceNo] == 'null' { mutate { remove_field => ["ReferenceNo"] } }
  if [TenantId] == 'null' { mutate { remove_field => ["TenantId"] } }
  if [lineItem_intervalUsageStart] == 'null' { mutate { remove_field => ["lineItem_intervalUsageStart"] } }
  if [lineItem_intervalUsageEnd] == 'null' { mutate { remove_field => ["lineItem_intervalUsageEnd"] } }
  if [Service] == 'null' { mutate { remove_field => ["Service"] } }
  if [CompartmentId] == 'null' { mutate { remove_field => ["CompartmentId"] } }
  if [CompartmentName] == 'null' { mutate { remove_field => ["CompartmentName"] } }
  if [Region] == 'null' { mutate { remove_field => ["Region"] } }
  if [AvailabilityDomain] == 'null' { mutate { remove_field => ["AvailabilityDomain"] } }
  if [ResourceId] == 'null' { mutate { remove_field => ["ResourceId"] } }
  if [Billed_Quantity_Regular] == 'null' { mutate { replace => { "Billed_Quantity_Regular" => "0.0" } } }
  if [Billed_Quantity_Overage] == 'null' { mutate { replace => { "Billed_Quantity_Overage" => "0.0" } } }
  if [SubscriptionId] == 'null' { mutate { remove_field => ["SubscriptionId"] } }
  if [ProductSku] == 'null' { mutate { remove_field => ["ProductSku"] } }
  if [Description] == 'null' { mutate { remove_field => ["Description"] } }
  if [Unit_Price_Regular] == 'null' { mutate { replace => {"Unit_Price_Regular" => "0.0" } } }
  if [Unit_Price_Overage] == 'null' { mutate { replace => {"Unit_Price_Overage" => "0.0" } } }
  if [Cost_Local_Regular] == 'null' { mutate { replace => {"Cost_Local_Regular" => "0.0" } } }
  if [Cost_Local_Overage] == 'null' { mutate { replace => {"Cost_Local_Overage" => "0.0" } } }
  if [CurrencyCode] == 'null' { mutate { remove_field => ["CurrencyCode"] } }
  if [Billing_Unit_Readable] == 'null' { mutate { remove_field => ["Billing_Unit_Readable"] } }
  if [SkuUnitDescription] == 'null' { mutate { remove_field => ["SkuUnitDescription"] } }
  if [OverageFlag] == 'null' { mutate { remove_field => ["OverageFlag"] } }
  if [IsCorrection] == 'null' { mutate { remove_field => ["IsCorrection"] } }
  if [BackreferenceNo] == 'null' { mutate { remove_field => ["BackreferenceNo"] } }
  if [Automation_Backup_Policy] == 'null' { mutate { remove_field => ["Automation_Backup_Policy"] } }
  if [Automation_EndDate] == 'null' { mutate { remove_field => ["Automation_EndDate"] } }
  if [Automation_Schedule] == 'null' { mutate { remove_field => ["Automation_Schedule"] } }
  if [Automation_StartDate] == 'null' { mutate { remove_field => ["Automation_StartDate"] } }
  if [Business_Adminby] == 'null' { mutate { remove_field => ["Business_Adminby"] } }
  if [Business_Costcenter] == 'null' { mutate { remove_field => ["Business_Costcenter"] } }
  if [Business_Market] == 'null' { mutate { remove_field => ["Business_Market"] } }
  if [Business_Organization] == 'null' { mutate { remove_field => ["Business_Organization"] } }
  if [Business_Owner] == 'null' { mutate { remove_field => ["Business_Owner"] } }
  if [Business_Project_Id] == 'null' { mutate { remove_field => ["Business_Project_Id"] } }
  if [Business_Service] == 'null' { mutate { remove_field => ["Business_Service"] } }
  if [Business_Workload_id] == 'null' { mutate { remove_field => ["Business_Workload_id"] } }
  if [DOC] == 'null' { mutate { remove_field => ["DOC"] } }
  if [Name] == 'null' { mutate { remove_field => ["Name"] } }
  if [Project] == 'null' { mutate { remove_field => ["Project"] } }
  if [Purpose] == 'null' { mutate { remove_field => ["Purpose"] } }
  if [Security_Compliance] == 'null' { mutate { remove_field => ["Security_Compliance"] } }
  if [Security_Patchlevel] == 'null' { mutate { remove_field => ["Security_Patchlevel"] } }
  if [Security_Patchlevel_VNC] == 'null' { mutate { remove_field => ["Security_Patchlevel_VNC"] } }
  if [Technical_Application] == 'null' { mutate { remove_field => ["Technical_Application"] } }
  if [Technical_Cluster] == 'null' { mutate { remove_field => ["Technical_Cluster"] } }
  if [Technical_Environment] == 'null' { mutate { remove_field => ["Technical_Environment"] } }
  if [Technical_Platform] == 'null' { mutate { remove_field => ["Technical_Platform"] } }
  if [Technical_Requestedby] == 'null' { mutate { remove_field => ["Technical_Requestedby"] } }
  if [Technical_Resource_Name] == 'null' { mutate { remove_field => ["Technical_Resource_Name"] } }
  if [Technical_Resource_Role] == 'null' { mutate { remove_field => ["Technical_Resource_Role"] } }
  if [Technical_Staging] == 'null' { mutate { remove_field => ["Technical_Staging"] } }
  if [Technical_Ucmdb_Id] == 'null' { mutate { remove_field => ["Technical_Ucmdb_Id"] } }
  if [Technical_Version] == 'null' { mutate { remove_field => ["Technical_Version"] } }
  if [Bds-Instance] == 'null' { mutate { remove_field => ["Bds-Instance"] } }
  if [Mail] == 'null' { mutate { remove_field => ["Mail"] } }
  if [Orcl-cloud_free-tier-retained] == 'null' { mutate { remove_field => ["Orcl-cloud_free-tier-retained"] } }
  if [Owner] == 'null' { mutate { remove_field => ["Owner"] } }
  if [Purpose2] == 'null' { mutate { remove_field => ["Purpose2"] } }
  if [Test] == 'null' { mutate { remove_field => ["Test"] } }
  if [Type] == 'null' { mutate { remove_field => ["Type"] } }
  if [tags/b] == 'null' { mutate { remove_field => ["tags/b"] } }


  ## FIX Technical_Staging ##
  ruby {
    code => 'if event.get("Technical_Staging") == "Verdadero" or event.get("Technical_Staging") == "True" or  event.get("Technical_Staging") == "true" then event.set("Technical_Staging", "true") elsif event.get("Technical_Staging") == "Falso" or event.get("Technical_Staging") == "False" or event.get("Technical_Staging") == "false" then event.set("Technical_Staging", "false") else event.set("Technical_Staging", "false") end'
  }

  ## Calculo Periodo ##
  dissect {
    mapping => {
      "lineItem_intervalUsageStart" => "%{year}-%{mes}-%{resto}"
    }
  }
  mutate {
  ## Creo Campo Periodo ##
    add_field => {"Period" => "%{mes}/%{year}"}
  ## Cambiar a Mayusculas los campos agrupables ##
    uppercase => [
      "Business_Adminby",
      "Business_Costcenter",
      "Business_Market",
      "Business_Organization",
      "Business_Owner",
      "Business_Service",
      "Technical_Application",
      "Technical_Environment",
      "Region"
    ]
  }
  ## Enrich con Indice Auxiliar ##
  elasticsearch {
    hosts => ["https://rgioddbprd57455.dtvpan.com:9200","https://rgioddbprd57456.dtvpan.com:9200","https://rgioddbprd57457.dtvpan.com:9200"]
    user => "logstash"
    password => "logstash"
    index => "auxiliar"
    query_template => "/etc/logstash/default/querys_files/query.json"
    fields => {
      "AccountVendor" => "Vendor"
      "AccountName" => "AccountName"
      "AccountAcronym" => "AccountAcronym"
      "PeriodStartDay" => "Period_Start_raw"
      "BillingStartPeriod" => "Billing_Cycle_Start_raw"
      "BillingFinishPeriod" => "Billing_Cycle_End_raw"
      "FX" => "FX"
      "BillingDays" => "Billing_Days"
      "BillingCycle" => "Billing_Cycle"
      "BillingCycleTotal" => "Billing_Cycle_Total"
      "Budget" => "Budget"
      "BudgetType" => "BudgetType"
      "Billing_ID" => "Billing_ID"
    }
  }
  mutate {
  ## Agrego Campo Billing Balance ##
    add_field => {"Billing_Cycle_Balance" => "%{Billing_Cycle}/%{Billing_Cycle_Total}"}
  ## Conversion Tipo de Campos CSV y Enrich ##
    convert => {
      "OverageFlag" => "boolean"
      "IsCorrection" => "boolean"
      "SubscriptionId" => "integer"
      "Billed_Quantity_Regular" => "float"
      "Billed_Quantity_Overage" => "float"
      "Unit_Price_Regular" => "float"
      "Unit_Price_Overage" => "float"
      "Cost_Local_Regular" => "float"
      "Cost_Local_Overage" => "float"
      "FX" => "float"
      "Budget" => "float"
      "Orcl-cloud_free-tier-retained" => "boolean"
      "BillingDays" => "integer"
    }
  }

  ## Conversion de Fechas ##
  date {
    match => ["lineItem_intervalUsageStart","ISO8601"]
    target => "Date"
  }
  date {
    match => ["Period_Start_raw","dd/MM/yyyy"]
    target => "Period_Start"
  }
  date {
    match => ["Billing_Cycle_Start_raw","dd/MM/yyyy"]
    target => "Billing_Cycle_Start"
  }
  date {
    match => ["Billing_Cycle_End_raw","dd/MM/yyyy"]
    target => "Billing_Cycle_End"
  }

  ## Creo campos de Control ##

  ruby {
    code => 'event.set("Batch_Date", Time.parse(event.get("@timestamp").to_s).strftime("%Y-%m-%dT%H:%M:00.000Z"))'
  }

  date {
    match => ["Batch_Date", "ISO8601"]
  }

  ruby {
    code => 'event.set("path", event.get("path").split("/").last)'
  }

  dissect {
    mapping => {
      "path" => "%{filename}_%{ext}"
    }
  }

  ## Fechas Calculadas ###
  ruby {
    init => 'require "time"'
    code => '
        diff = ((event.get("Date") - event.get("Period_Start")) / 86400) +1
        event.set("Period_Days_Elapsed", diff.to_i)'
  }
  ruby {
    init => 'require "time"'
    code => '
        diff = ((event.get("Date") - event.get("Billing_Cycle_Start")) / 86400) +1
        event.set("Billing_Cycle_Days_Elapsed", diff.to_i)'
  }
  ruby {
    init => 'require "time"'
    code => '
        diff = (event.get("Billing_Days") - event.get("Billing_Cycle_Days_Elapsed"))
        event.set("Billing_Cycle_Days_Remaining", diff.to_i)'
  }
  ## Metricas Calculadas ##
  ruby {
    code => 'event.set("Cost_Local_Total", event.get("Cost_Local_Regular") + event.get("Cost_Local_Overage"))'
  }
  ruby {
    code => 'if event.get("Cost_Local_Regular") == 0 then event.set("Cost_USD_Regular",0) else event.set("Cost_USD_Regular", event.get("Cost_Local_Regular") / event.get("FX")) end '
  }
  ruby {
    code => 'if event.get("Cost_Local_Overage") == 0 then event.set("Cost_USD_Overage",0).to_f else event.set("Cost_USD_Overage", event.get("Cost_Local_Regular") / event.get("FX")) end'
  }
  ruby {
    code => 'event.set("Cost_USD_Total", event.get("Cost_USD_Regular") + event.get("Cost_USD_Overage"))'
  }
  ruby {
    code => 'event.set("Billed_Quantity_Total", event.get("Billed_Quantity_Regular") + event.get("Billed_Quantity_Overage"))'
  }
  ruby {
    code => 'if event.get("Cost_Local_Total") == 0 or event.get("Billed_Quantity_Total") == 0 then event.set("Unit_Price_Overall",0).to_f else event.set("Unit_Price_Overall", event.get("Cost_Local_Total") / event.get("Billed_Quantity_Total")) end '
  }
  ruby {
    code => 'if event.get("Cost_Local_Regular") == 0 or event.get("Unit_Price_Regular") == 0 then event.set("Units_Consumed_Regular",0).to_f else event.set("Units_Consumed_Regular", event.get("Cost_Local_Regular") / event.get("Unit_Price_Regular")) end'
  }
  ruby {
    code => 'if event.get("Cost_Local_Overage") == 0 or event.get("Unit_Price_Overage") == 0 then event.set("Units_Consumed_Overage",0).to_f else event.set("Units_Consumed_Overage", event.get("Cost_Local_Overage") / event.get("Unit_Price_Overage")) end'
  }
  ruby {
    code => 'event.set("Units_Consumed_Total", event.get("Units_Consumed_Regular") + event.get("Units_Consumed_Overage"))'
  }

  ## Convierto campos long to float
  mutate {
    convert => {
      "Cost_USD_Total" => "float"
      "Cost_USD_Regular" => "float"
      "Cost_USD_Overage" => "float"
      "Billed_Quantity_Total" => "float"
      "Unit_Price_Overall" => "float"
      "Units_Consumed_Regular" => "float"
      "Units_Consumed_Overage" => "float"
      "Units_Consumed_Total" => "float"
    }
  }

  ## Elimino campos temporales ##
  mutate {
    remove_field => [
      "ReferenceNo",
      "Automation_StartDate",
      "lineItem_intervalUsageStart",
      "message",
      "Billing_Cycle_Start_raw",
      "Billing_Cycle_End_raw",
      "lineItem_intervalUsageEnd",
      "resto",
      "year",
      "mes",
      "Period_Start_raw",
      "@timestamp",
      "@version",
      "host",
      "Purpose2",
      "ext"
    ]
  }
}
output {
  elasticsearch {
    hosts => ["host1","host2"]
    cacert => "/path/to/ca.crt"
## FIX Mobile ##
    pipeline => "combo"
    user => "user"
    password => "password"
    ssl => true
    index => "oci-dc"
  }
#stdout {}
}

pipelines.yml:

# This file is where you define your pipelines. You can define multiple.
# For more information on multiple pipelines, see the documentation:
#   https://www.elastic.co/guide/en/logstash/current/multiple-pipelines.html

- pipeline.id: oci_br
  path.config: "/u01/testdir/ApiOci/oci-br/logstashconf/oci_br.conf"

- pipeline.id: oci_dc
  path.config: "/u01/testdir/ApiOci/oci-dc/logstashconf/oci_dc.conf"

Thank you very much for the help.

leandrojmp · May 29, 2023, 3:09pm

Did your pipelines worked before? If yes, waht did you changed that it stopped working? I do not see anything that could be an issue.

From the screenshot you shared logstash can not start both of your pipelines.

Do you have anything else in Logstash logs? Please share logstash logs as plain text, not screenshot.

nml1988 · May 29, 2023, 3:25pm

Yes, everything was working fine until a couple of weeks ago.

Last 50 lines:

[2023-05-29T15:11:45,628][WARN ][logstash.outputs.elasticsearch][oci_br] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[2023-05-29T15:11:45,627][WARN ][logstash.outputs.elasticsearch][oci_dc] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[2023-05-29T15:11:45,699][WARN ][logstash.outputs.elasticsearch][oci_br] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.20:9200/"}
[2023-05-29T15:11:45,701][WARN ][logstash.outputs.elasticsearch][oci_dc] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.20:9200/"}
[2023-05-29T15:11:45,760][WARN ][logstash.outputs.elasticsearch][oci_dc] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.28:9200/"}
[2023-05-29T15:11:45,761][WARN ][logstash.outputs.elasticsearch][oci_br] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.28:9200/"}
[2023-05-29T15:11:45,807][INFO ][logstash.outputs.elasticsearch][oci_br] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["https://172.29.142.18:9200", "https://172.29.142.20:9200", "https://172.29.142.28:9200"]}
[2023-05-29T15:11:45,812][INFO ][logstash.outputs.elasticsearch][oci_dc] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["https://172.29.142.18:9200", "https://172.29.142.20:9200", "https://172.29.142.28:9200"]}
[2023-05-29T15:11:45,869][INFO ][logstash.outputs.elasticsearch][oci_br] Using a default mapping template {:es_version=>7, :ecs_compatibility=>:disabled}
[2023-05-29T15:11:45,872][INFO ][logstash.outputs.elasticsearch][oci_dc] Using a default mapping template {:es_version=>7, :ecs_compatibility=>:disabled}
[2023-05-29T15:11:45,898][INFO ][logstash.filters.elasticsearch][oci_br] New ElasticSearch filter client {:hosts=>["https://rgioddbprd57455.dtvpan.com:9200", "https://rgioddbprd57456.dtvpan.com:9200", "https://rgioddbprd57457.dtvpan.com:9200"]}
[2023-05-29T15:11:45,899][INFO ][logstash.filters.elasticsearch][oci_dc] New ElasticSearch filter client {:hosts=>["https://rgioddbprd57455.dtvpan.com:9200", "https://rgioddbprd57456.dtvpan.com:9200", "https://rgioddbprd57457.dtvpan.com:9200"]}
[2023-05-29T15:11:45,930][INFO ][logstash.outputs.elasticsearch][oci_br] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2023-05-29T15:11:45,930][INFO ][logstash.outputs.elasticsearch][oci_dc] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2023-05-29T15:11:46,140][ERROR][logstash.agent           ] Failed to execute action {:id=>:oci_dc, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<oci_dc>, action_result: false", :backtrace=>nil}
[2023-05-29T15:11:46,137][ERROR][logstash.agent           ] Failed to execute action {:id=>:oci_br, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<oci_br>, action_result: false", :backtrace=>nil}
[2023-05-29T15:11:46,337][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>5610}
[2023-05-29T15:11:51,392][INFO ][logstash.runner          ] Logstash shut down.
[2023-05-29T15:11:51,406][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[2023-05-29T15:12:03,474][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"7.9.2", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc OpenJDK 64-Bit Server VM 25.292-b10 on 1.8.0_292-b10 +indy +jit [linux-x86_64]"}
[2023-05-29T15:12:11,288][INFO ][org.reflections.Reflections] Reflections took 32 ms to scan 1 urls, producing 22 keys and 45 values
[2023-05-29T15:12:12,476][INFO ][logstash.outputs.elasticsearch][oci_dc] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[https://logstash:xxxxxx@172.29.142.18:9200/, https://logstash:xxxxxx@172.29.142.20:9200/, https://logstash:xxxxxx@172.29.142.28:9200/]}}
[2023-05-29T15:12:12,477][INFO ][logstash.outputs.elasticsearch][oci_br] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[https://logstash:xxxxxx@172.29.142.18:9200/, https://logstash:xxxxxx@172.29.142.20:9200/, https://logstash:xxxxxx@172.29.142.28:9200/]}}
[2023-05-29T15:12:12,827][WARN ][logstash.outputs.elasticsearch][oci_dc] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.18:9200/"}
[2023-05-29T15:12:12,826][WARN ][logstash.outputs.elasticsearch][oci_br] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.18:9200/"}
[2023-05-29T15:12:12,874][INFO ][logstash.outputs.elasticsearch][oci_br] ES Output version determined {:es_version=>7}
[2023-05-29T15:12:12,875][INFO ][logstash.outputs.elasticsearch][oci_dc] ES Output version determined {:es_version=>7}
[2023-05-29T15:12:12,877][WARN ][logstash.outputs.elasticsearch][oci_dc] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[2023-05-29T15:12:12,878][WARN ][logstash.outputs.elasticsearch][oci_br] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[2023-05-29T15:12:12,944][WARN ][logstash.outputs.elasticsearch][oci_dc] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.20:9200/"}
[2023-05-29T15:12:13,010][WARN ][logstash.outputs.elasticsearch][oci_dc] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.28:9200/"}
[2023-05-29T15:12:13,058][INFO ][logstash.outputs.elasticsearch][oci_dc] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["https://172.29.142.18:9200", "https://172.29.142.20:9200", "https://172.29.142.28:9200"]}
[2023-05-29T15:12:13,114][INFO ][logstash.outputs.elasticsearch][oci_dc] Using a default mapping template {:es_version=>7, :ecs_compatibility=>:disabled}
[2023-05-29T15:12:13,144][INFO ][logstash.filters.elasticsearch][oci_dc] New ElasticSearch filter client {:hosts=>["https://rgioddbprd57455.dtvpan.com:9200", "https://rgioddbprd57456.dtvpan.com:9200", "https://rgioddbprd57457.dtvpan.com:9200"]}
[2023-05-29T15:12:13,185][INFO ][logstash.outputs.elasticsearch][oci_dc] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2023-05-29T15:12:13,388][WARN ][logstash.outputs.elasticsearch][oci_br] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.20:9200/"}
[2023-05-29T15:12:13,399][ERROR][logstash.agent           ] Failed to execute action {:id=>:oci_dc, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<oci_dc>, action_result: false", :backtrace=>nil}
[2023-05-29T15:12:13,459][WARN ][logstash.outputs.elasticsearch][oci_br] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.28:9200/"}
[2023-05-29T15:12:13,488][INFO ][logstash.outputs.elasticsearch][oci_br] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["https://172.29.142.18:9200", "https://172.29.142.20:9200", "https://172.29.142.28:9200"]}
[2023-05-29T15:12:13,496][INFO ][logstash.filters.elasticsearch][oci_br] New ElasticSearch filter client {:hosts=>["https://rgioddbprd57455.dtvpan.com:9200", "https://rgioddbprd57456.dtvpan.com:9200", "https://rgioddbprd57457.dtvpan.com:9200"]}
[2023-05-29T15:12:13,495][INFO ][logstash.outputs.elasticsearch][oci_br] Using a default mapping template {:es_version=>7, :ecs_compatibility=>:disabled}
[2023-05-29T15:12:13,528][INFO ][logstash.outputs.elasticsearch][oci_br] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2023-05-29T15:12:13,534][ERROR][logstash.agent           ] Failed to execute action {:id=>:oci_br, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<oci_br>, action_result: false", :backtrace=>nil}
[2023-05-29T15:12:13,724][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>5610}
[2023-05-29T15:12:18,778][INFO ][logstash.runner          ] Logstash shut down.
[2023-05-29T15:12:18,790][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[2023-05-29T15:12:30,388][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"7.9.2", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc OpenJDK 64-Bit Server VM 25.292-b10 on 1.8.0_292-b10 +indy +jit [linux-x86_64]"}
[2023-05-29T15:12:38,016][INFO ][org.reflections.Reflections] Reflections took 766 ms to scan 1 urls, producing 22 keys and 45 values
[2023-05-29T15:12:39,203][INFO ][logstash.outputs.elasticsearch][oci_dc] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[https://logstash:xxxxxx@172.29.142.18:9200/, https://logstash:xxxxxx@172.29.142.20:9200/, https://logstash:xxxxxx@172.29.142.28:9200/]}}
[2023-05-29T15:12:39,201][INFO ][logstash.outputs.elasticsearch][oci_br] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[https://logstash:xxxxxx@172.29.142.18:9200/, https://logstash:xxxxxx@172.29.142.20:9200/, https://logstash:xxxxxx@172.29.142.28:9200/]}}
[2023-05-29T15:12:39,522][WARN ][logstash.outputs.elasticsearch][oci_dc] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.18:9200/"}
[2023-05-29T15:12:39,522][WARN ][logstash.outputs.elasticsearch][oci_br] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.18:9200/"}
[2023-05-29T15:12:39,560][INFO ][logstash.outputs.elasticsearch][oci_dc] ES Output version determined {:es_version=>7}
[2023-05-29T15:12:39,562][INFO ][logstash.outputs.elasticsearch][oci_br] ES Output version determined {:es_version=>7}
[2023-05-29T15:12:39,565][WARN ][logstash.outputs.elasticsearch][oci_br] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[2023-05-29T15:12:39,565][WARN ][logstash.outputs.elasticsearch][oci_dc] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[2023-05-29T15:12:39,625][WARN ][logstash.outputs.elasticsearch][oci_br] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.20:9200/"}
[2023-05-29T15:12:39,628][WARN ][logstash.outputs.elasticsearch][oci_dc] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.20:9200/"}
[2023-05-29T15:12:39,693][WARN ][logstash.outputs.elasticsearch][oci_br] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.28:9200/"}
[2023-05-29T15:12:39,696][WARN ][logstash.outputs.elasticsearch][oci_dc] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.28:9200/"}
[2023-05-29T15:12:39,734][INFO ][logstash.outputs.elasticsearch][oci_br] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["https://172.29.142.18:9200", "https://172.29.142.20:9200", "https://172.29.142.28:9200"]}
[2023-05-29T15:12:39,739][INFO ][logstash.outputs.elasticsearch][oci_dc] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["https://172.29.142.18:9200", "https://172.29.142.20:9200", "https://172.29.142.28:9200"]}
[2023-05-29T15:12:39,788][INFO ][logstash.outputs.elasticsearch][oci_br] Using a default mapping template {:es_version=>7, :ecs_compatibility=>:disabled}
[2023-05-29T15:12:39,794][INFO ][logstash.outputs.elasticsearch][oci_dc] Using a default mapping template {:es_version=>7, :ecs_compatibility=>:disabled}
[2023-05-29T15:12:39,817][INFO ][logstash.filters.elasticsearch][oci_dc] New ElasticSearch filter client {:hosts=>["https://rgioddbprd57455.dtvpan.com:9200", "https://rgioddbprd57456.dtvpan.com:9200", "https://rgioddbprd57457.dtvpan.com:9200"]}
[2023-05-29T15:12:39,818][INFO ][logstash.filters.elasticsearch][oci_br] New ElasticSearch filter client {:hosts=>["https://rgioddbprd57455.dtvpan.com:9200", "https://rgioddbprd57456.dtvpan.com:9200", "https://rgioddbprd57457.dtvpan.com:9200"]}
[2023-05-29T15:12:39,847][INFO ][logstash.outputs.elasticsearch][oci_dc] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2023-05-29T15:12:39,847][INFO ][logstash.outputs.elasticsearch][oci_br] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2023-05-29T15:12:40,042][ERROR][logstash.agent           ] Failed to execute action {:id=>:oci_dc, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<oci_dc>, action_result: false", :backtrace=>nil}
[2023-05-29T15:12:40,042][ERROR][logstash.agent           ] Failed to execute action {:id=>:oci_br, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<oci_br>, action_result: false", :backtrace=>nil}
[2023-05-29T15:12:40,235][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>5610}
[2023-05-29T15:12:45,286][INFO ][logstash.runner          ] Logstash shut down.
[2023-05-29T15:12:45,298][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[2023-05-29T15:12:56,996][INFO ][logstash.runner          ] Starting Logstash {"logstash.version"=>"7.9.2", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc OpenJDK 64-Bit Server VM 25.292-b10 on 1.8.0_292-b10 +indy +jit [linux-x86_64]"}
[2023-05-29T15:13:04,606][INFO ][org.reflections.Reflections] Reflections took 33 ms to scan 1 urls, producing 22 keys and 45 values
[2023-05-29T15:13:05,844][INFO ][logstash.outputs.elasticsearch][oci_dc] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[https://logstash:xxxxxx@172.29.142.18:9200/, https://logstash:xxxxxx@172.29.142.20:9200/, https://logstash:xxxxxx@172.29.142.28:9200/]}}
[2023-05-29T15:13:05,845][INFO ][logstash.outputs.elasticsearch][oci_br] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[https://logstash:xxxxxx@172.29.142.18:9200/, https://logstash:xxxxxx@172.29.142.20:9200/, https://logstash:xxxxxx@172.29.142.28:9200/]}}
[2023-05-29T15:13:06,179][WARN ][logstash.outputs.elasticsearch][oci_dc] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.18:9200/"}
[2023-05-29T15:13:06,178][WARN ][logstash.outputs.elasticsearch][oci_br] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.18:9200/"}
[2023-05-29T15:13:06,219][INFO ][logstash.outputs.elasticsearch][oci_br] ES Output version determined {:es_version=>7}
[2023-05-29T15:13:06,218][INFO ][logstash.outputs.elasticsearch][oci_dc] ES Output version determined {:es_version=>7}
[2023-05-29T15:13:06,223][WARN ][logstash.outputs.elasticsearch][oci_br] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[2023-05-29T15:13:06,221][WARN ][logstash.outputs.elasticsearch][oci_dc] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document _type {:es_version=>7}
[2023-05-29T15:13:06,298][WARN ][logstash.outputs.elasticsearch][oci_dc] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.20:9200/"}
[2023-05-29T15:13:06,301][WARN ][logstash.outputs.elasticsearch][oci_br] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.20:9200/"}
[2023-05-29T15:13:06,359][WARN ][logstash.outputs.elasticsearch][oci_br] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.28:9200/"}
[2023-05-29T15:13:06,399][INFO ][logstash.outputs.elasticsearch][oci_br] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["https://172.29.142.18:9200", "https://172.29.142.20:9200", "https://172.29.142.28:9200"]}
[2023-05-29T15:13:06,441][WARN ][logstash.outputs.elasticsearch][oci_dc] Restored connection to ES instance {:url=>"https://logstash:xxxxxx@172.29.142.28:9200/"}
[2023-05-29T15:13:06,461][INFO ][logstash.outputs.elasticsearch][oci_br] Using a default mapping template {:es_version=>7, :ecs_compatibility=>:disabled}
[2023-05-29T15:13:06,478][INFO ][logstash.outputs.elasticsearch][oci_dc] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["https://172.29.142.18:9200", "https://172.29.142.20:9200", "https://172.29.142.28:9200"]}
[2023-05-29T15:13:06,484][INFO ][logstash.outputs.elasticsearch][oci_dc] Using a default mapping template {:es_version=>7, :ecs_compatibility=>:disabled}
[2023-05-29T15:13:06,495][INFO ][logstash.filters.elasticsearch][oci_br] New ElasticSearch filter client {:hosts=>["https://rgioddbprd57455.dtvpan.com:9200", "https://rgioddbprd57456.dtvpan.com:9200", "https://rgioddbprd57457.dtvpan.com:9200"]}
[2023-05-29T15:13:06,494][INFO ][logstash.filters.elasticsearch][oci_dc] New ElasticSearch filter client {:hosts=>["https://rgioddbprd57455.dtvpan.com:9200", "https://rgioddbprd57456.dtvpan.com:9200", "https://rgioddbprd57457.dtvpan.com:9200"]}
[2023-05-29T15:13:06,530][INFO ][logstash.outputs.elasticsearch][oci_dc] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2023-05-29T15:13:06,530][INFO ][logstash.outputs.elasticsearch][oci_br] Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{"index.refresh_interval"=>"5s", "number_of_shards"=>1}, "mappings"=>{"dynamic_templates"=>[{"message_field"=>{"path_match"=>"message", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false}}}, {"string_fields"=>{"match"=>"*", "match_mapping_type"=>"string", "mapping"=>{"type"=>"text", "norms"=>false, "fields"=>{"keyword"=>{"type"=>"keyword", "ignore_above"=>256}}}}}], "properties"=>{"@timestamp"=>{"type"=>"date"}, "@version"=>{"type"=>"keyword"}, "geoip"=>{"dynamic"=>true, "properties"=>{"ip"=>{"type"=>"ip"}, "location"=>{"type"=>"geo_point"}, "latitude"=>{"type"=>"half_float"}, "longitude"=>{"type"=>"half_float"}}}}}}}
[2023-05-29T15:13:06,724][ERROR][logstash.agent           ] Failed to execute action {:id=>:oci_dc, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<oci_dc>, action_result: false", :backtrace=>nil}
[2023-05-29T15:13:06,724][ERROR][logstash.agent           ] Failed to execute action {:id=>:oci_br, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<oci_br>, action_result: false", :backtrace=>nil}
[2023-05-29T15:13:06,914][INFO ][logstash.agent           ] Successfully started Logstash API endpoint {:port=>5610}
[2023-05-29T15:13:11,970][INFO ][logstash.runner          ] Logstash shut down.
[2023-05-29T15:13:11,982][ERROR][org.logstash.Logstash    ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

Thank you very much!!!

leandrojmp · May 29, 2023, 5:33pm

Yeah, what changed? The pipeline was changed? If the pipeline was working and was not changed, then something else was changed.

Your log still says that Logstash could not create the pipeline for your configurations, but does not says why, you could try to enable the debug logging to see if this gives more information.

Also, since you are running it as a service, please check the system logs, /var/log/messages or /var/log/syslog depending on the distribution, there may be more information there.

system · June 26, 2023, 5:34pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.