Errors when connecting Filebeat to logstash

[Baco]

Hello,

Would you like to help me understand why i have errors below when I try to connect filebeat to logstash.

An unexpected error occurred! {:error=>#<NoMethodError: undefined method <=' for nil:NilClass>, :backtrace=>["(eval):145:inoutput_func'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:400:in output_batch'", "org/jruby/RubyProc.java:281:incall'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:224:in each'", "org/jruby/RubyHash.java:1342:ineach'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:223:in each'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:394:inoutput_batch'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:352:in worker_loop'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:317:instart_workers'"]}

[tatdat (Dat Pham Tat)]

What are your config logstash and filebeat looklike ?

[Baco]

Thanks @tatdat for your answer,

The change i have done in filebeat are:
paths:
#- /var/log/*.log
- /var/log/suricata/eve.json

output.logstash:

The Logstash hosts

hosts: ["192.168.1.10:5044"]

The logstash file is :
input {
file {
type => "Local_Log"
path => "/var/log/*.log"
}

    beats {
    port => 5044
    codec => json
    }

}
output {
stdout {
codec => rubydebug
}
}

[tatdat (Dat Pham Tat)]

Do you have any config another?

I'm looking in your config, it's very simple and dont have problem in your logstash config ..
But I saw in error log , have error

undefined method `<='

May be have error in condition (filter) in logstash?. Im not sure

[Baco]

Hello,

No I haven't another config.

If I comment plugin beats, everything work normaly.

[tatdat (Dat Pham Tat)]

I found it @Baco : "json" not json

    beats {
        port => 5044
        codec => "json"
    }

Tell me know if it worked

[Baco]

Hello @tatdat

I change this but no change to the problem. I think codec is not mandatory in plugin beats.

The error in filebeat computer is:

2017/07/13 09:39:00.037221 sync.go:85: ERR Failed to publish events caused by: read tcp 192.168.1.110:38854->192.168.1.10:5044: read: connection reset by peer