[ERROR][logstash.javapipeline

``` [ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information fromlicense server {:message=>"Unsupported or unrecognized SSL message"}Preformatted text
[ERROR][logstash.javapipeline ][main] Pipeline error {:pipeline_id=>"main", :exception=>#<Manticore::UnknownException: Unsupported or unrecognized SSL message>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.0-java/lib/manticore/response.rb:37:in block in initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.7.0-java/lib/manticore/response.rb:79:in call'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:74:in perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:317:in perform_request_to_url'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:260:in health_check_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:269:in block in healthcheck!'", "org/jruby/RubyHash.java:1415:in each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:265:in healthcheck!'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:367:in update_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:83:in update_initial_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:77:in start'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:303:in build_pool'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client.rb:64:in initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:106:in create_http_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:102:in build'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/plugin_mixins/elasticsearch/common.rb:34:in build_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-10.8.2-java/lib/logstash/outputs/elasticsearch.rb:270:in register'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:131:in register'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:68:in register'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:228:in block in register_plugins'", "org/jruby/RubyArray.java:1809:in each'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:227:in register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:585:in maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:240:in start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:185:in run'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:137:in block in start'"], "pipeline.sources"=>["/usr/share/logstash/pipeline/logstash.conf"], :thread=>"#<Thread:0x21896b59 run>"}

The most likely you are trying to establish HTTP where HTTPS forced on the output side(Elasticsearch or whatever).

1 Like

Like @Rios said... Check your logstash's output config, if the elasticsearch endpoint is HTTP instead HTTPS.

1 Like

I tried to change the hosts of logstash to http
[ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information fromlicense server {:message=>"Got response code '401' contacting Elasticsearch at URL 'http://xxx.xxx.xxx.xx:9201/_xpack'"}
2022-09-22T01:46:31.158777649Z [2022-09-22T01:46:31,158**][ERROR]**[logstash.monitoring.internalpipelinesource] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.

[logstash.outputs.elasticsearch][main] Unable to get license information {:url=>"http://rvcope:xxxxxx@sxxx.xxx.xxx.xx:9201/", :error_type=>LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError, :error=>"Got response code '400' contacting Elasticsearch at URL 'http://seroiudb00540.sero.gic.ericsson.se:9201/_license'"}

ERROR][logstash.outputs.elasticsearch][main] Failed to install template. {:message=>"Got response code '403' contacting Elasticsearch at URL 'http://xxx.xxx.xxx.xx:9201/_template/logstash'", :class=>"LogStash::Outputs::Elasticsearch::HttpClient::Pool::BadResponseCodeError", :backtrace=>[

Thank you very much. I'm looking at this problem, but I'm confused. Can you help me

Hello...

401 error mean "Unauthorized", please check the elasticsearch's authentication (username/password).

Thank you very much for trying to get your answer

I can log in to kbana with the account in the configuration file and query the data. Does this verify that my account has permissions

Does your elasticsearch endpoint listen on port 9201?

I don't know where the cause is, but the investigation has been fruitless for a long time

yes 9201

Use curl

curl -u user:pass http://elastichost:9201 - try with -k and https, and without

I went to my elasticsearch curl -u HTTP with the command you gave me,
However, I do not understand how to configure or make a strategy. There is error when logstash is connected.


Boss, do you know what this problem is? What needs to be modified? Please give me your advice

Hi @wxhgwh We ask specific questions and I do not see specific answers if you can be specific we can probably help if not it is very hard.

This message appears to indicate elasticsearch is using HTTPS but we do not know.
{:message=>"Unsupported or unrecognized SSL message"}

The very first specific question is is Elasticsearch running on HTTP or HTTPS.

Please be very specific.

Which one works? or do neither

HTTP
curl -u user:password http://<host-or-ip>:9201

or HTTPS
curl -k -u user:password https://<host-or-ip>:9201

Then we can help you with logstash...

Hello, my problem has been solved. Thank you for your help
Let me introduce my environment. I started logstash with Docker, and then modified logstach.conf,
And reported an error,

It says that the connected is the default Elasticsearch: 9200
However, my configuration file is not at this address. I hope to get your help. Thank you very much. Can you tell me which configuration file should be modified

logstash.conf

error

docker stack.yml

Pasting images of text make it very difficult to help we can not cut-n-paste and help you and many people can not even see / read them.

Looks to me your docker config is not using finding your logstash.conf

I would read this carefully, and make sure these files are readable

Bind-mounted configuration files will retain the same permissions and ownership within the container that they have on the host system. Be sure to set permissions such that the files will be readable and, ideally, not writeable by the container’s logstash user (UID 1000).

perhaps you should try directories not just the individual files...

Okay Thank you very much