[ERROR][logstash.javapipeline

wxhgwh · September 20, 2022, 7:25am

``` [ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information fromlicense server {:message=>"Unsupported or unrecognized SSL message"}Preformatted text
[ERROR][logstash.javapipeline ][main] Pipeline error {:pipeline_id=>"main", :exception=>#<Manticore::UnknownException: Unsupported or unrecognized SSL message>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.0-java/lib/manticore/response.rb:37:in block in initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.0-java/lib/manticore/response.rb:79:in call'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:74:in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:317:in perform_request_to_url'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:260:in health_check_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:269:in block in healthcheck!'", "org/jruby/RubyHash.java:1415:in each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:265:in healthcheck!'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:367:in update_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:83:in update_initial_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:77:in start'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:303:in build_pool'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:64:in initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:106:in create_http_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:102:in build'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/plugin_mixins/elasticsearch/common.rb:34:in build_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch.rb:270:in register'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:131:in register'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:68:in register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:228:in block in register_plugins'", "org/jruby/RubyArray.java:1809:in each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:227:in register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:585:in maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:240:in start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:185:in run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:137:in block in start'"], "pipeline.sources"=>["/usr/share/logstash/pipeline/logstash.conf"], :thread=>"#<Thread:0x21896b59 run>"}

Rios · September 21, 2022, 4:26pm

The most likely you are trying to establish HTTP where HTTPS forced on the output side(Elasticsearch or whatever).

joao · September 21, 2022, 7:10pm

Like @Rios said... Check your logstash's output config, if the elasticsearch endpoint is HTTP instead HTTPS.

wxhgwh · September 22, 2022, 1:57am

I tried to change the hosts of logstash to http
[ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information fromlicense server {:message=>"Got response code '401' contacting Elasticsearch at URL 'http://xxx.xxx.xxx.xx:9201/_xpack'"}
2022-09-22T01:46:31.158777649Z [2022-09-22T01:46:31,158**][ERROR]**[logstash.monitoring.internalpipelinesource] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.

[logstash.outputs.elasticsearch][main] Unable to get license information {:url=>"http://rvcope:xxxxxx@sxxx.xxx.xxx.xx:9201/", :error_type=>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '400' contacting Elasticsearch at URL 'http://seroiudb00540.sero.gic.ericsson.se:9201/_license'"}

ERROR][logstash.outputs.elasticsearch][main] Failed to install template. {:message=>"Got response code '403' contacting Elasticsearch at URL 'http://xxx.xxx.xxx.xx:9201/_template/logstash'", :class=>"LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError", :backtrace=>[

wxhgwh · September 22, 2022, 1:58am

Thank you very much. I'm looking at this problem, but I'm confused. Can you help me

joao · September 22, 2022, 2:15am

Hello...

401 error mean "Unauthorized", please check the elasticsearch's authentication (username/password).

wxhgwh · September 22, 2022, 2:17am

Thank you very much for trying to get your answer

wxhgwh · September 22, 2022, 7:14am

I can log in to kbana with the account in the configuration file and query the data. Does this verify that my account has permissions

joao · September 22, 2022, 10:26am

Does your elasticsearch endpoint listen on port 9201?

wxhgwh · September 23, 2022, 2:11am

I don't know where the cause is, but the investigation has been fruitless for a long time

wxhgwh · September 23, 2022, 2:13am

yes 9201

Rios · September 23, 2022, 3:08am

Use curl

curl -u user:pass http://elastichost:9201 - try with -k and https, and without

wxhgwh · September 23, 2022, 6:30am

I went to my elasticsearch curl -u HTTP with the command you gave me,
However, I do not understand how to configure or make a strategy. There is error when logstash is connected.

wxhgwh · September 26, 2022, 3:09am

Boss, do you know what this problem is? What needs to be modified? Please give me your advice

stephenb · September 26, 2022, 3:21am

Hi @wxhgwh We ask specific questions and I do not see specific answers if you can be specific we can probably help if not it is very hard.

This message appears to indicate elasticsearch is using HTTPS but we do not know.
{:message=>"Unsupported or unrecognized SSL message"}

The very first specific question is is Elasticsearch running on HTTP or HTTPS.

Please be very specific.

Which one works? or do neither

HTTP
curl -u user:password http://<host-or-ip>:9201

or HTTPS
curl -k -u user:password https://<host-or-ip>:9201

Then we can help you with logstash...

wxhgwh · September 26, 2022, 3:27am

Hello, my problem has been solved. Thank you for your help
Let me introduce my environment. I started logstash with Docker, and then modified logstach.conf,
And reported an error,

It says that the connected is the default Elasticsearch: 9200
However, my configuration file is not at this address. I hope to get your help. Thank you very much. Can you tell me which configuration file should be modified

wxhgwh · September 26, 2022, 3:31am

logstash.conf

error

docker stack.yml

stephenb · September 26, 2022, 3:40am

Pasting images of text make it very difficult to help we can not cut-n-paste and help you and many people can not even see / read them.

Looks to me your docker config is not using finding your logstash.conf

I would read this carefully, and make sure these files are readable

Bind-mounted configuration files will retain the same permissions and ownership within the container that they have on the host system. Be sure to set permissions such that the files will be readable and, ideally, not writeable by the container’s logstash user (UID 1000).

perhaps you should try directories not just the individual files...

wxhgwh · September 26, 2022, 3:44am

Okay Thank you very much

system · October 24, 2022, 3:44am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.