I've been using Logstash for over two years, now. I'd now like to have Logstash execute a shell script when certain patterns are seen. To this end, I installed the logstash-output-exec plugin. However, this appears to crash Logstash. I've tried multiple versions of Logstash and multiple Java interpreters. I'm simply at a loss.
We'd like to move away from Logsurfer... but doing so requires the "exec" functionality. Anyway, Logstash seems to run for up to ~15s before respawning (ad infinitum/ab latrinae).
I created the most basic Logstash config possible... and this still fails (with the exec line uncommented):
input {
file {
path => ["/var/log/messages"]
codec => plain { charset => "ISO-8859-1" }
}
}
filter {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{GREEDYDATA:msg}" }
add_field => { "svc_name" => "noise" }
}
}
output {
stdout { codec => rubydebug }
#exec { command => "/opt/foo/RabbitMQ/send-ssl.py -n %{syslog_hostname} &" }
}
grep JAVA ../startup.options
#JAVACMD=/usr/bin/java
#JAVA_HOME=/opt/jre1.8.0_231
#JAVACMD=/opt/jre1.8.0_231/bin/java
JAVA_HOME=/opt/jdk-11.0.5
JAVACMD=/opt/jdk-11.0.5/bin/java
]# rpm -qa|grep -i logst
logstash-7.4.2-1.noarch
]# java -version
openjdk version "1.8.0_222"