Errors when connecting Filebeat to logstash


Would you like to help me understand why i have errors below when I try to connect filebeat to logstash.

An unexpected error occurred! {:error=>#<NoMethodError: undefined method <=' for nil:NilClass>, :backtrace=>["(eval):145:inoutput_func'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:400:in output_batch'", "org/jruby/'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:224:in each'", "org/jruby/'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/util/wrapped_synchronous_queue.rb:223:in each'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:394:inoutput_batch'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:352:in worker_loop'", "/etc/Elastic_Stack/logstash-5.4.0/logstash-core/lib/logstash/pipeline.rb:317:instart_workers'"]}

What are your config logstash and filebeat looklike ?

Thanks @tatdat for your answer,

The change i have done in filebeat are:
#- /var/log/*.log
- /var/log/suricata/eve.json


The Logstash hosts

hosts: [""]

The logstash file is :
input {
file {
type => "Local_Log"
path => "/var/log/*.log"

    beats {
    port => 5044
    codec => json

output {
stdout {
codec => rubydebug

Do you have any config another?

I'm looking in your config, it's very simple and dont have problem in your logstash config ..
But I saw in error log , have error

undefined method `<='

May be have error in condition (filter) in logstash?. Im not sure


No I haven't another config.

If I comment plugin beats, everything work normaly.

I found it @Baco : "json" not json

    beats {
        port => 5044
        codec => "json"

Tell me know if it worked :slight_smile:

Hello @tatdat

I change this but no change to the problem. I think codec is not mandatory in plugin beats.

The error in filebeat computer is:

2017/07/13 09:39:00.037221 sync.go:85: ERR Failed to publish events caused by: read tcp> read: connection reset by peer

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.