Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id

Elastic Stack Logstash
1

I'm currently trying to use Input http_poller to make an API call to a site to pull some data. However I keep getting the following error:

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [A-Za-z0-9_], [ \\t\\r\\n], \"#\", \"=>\" at line 11, column 13 (byte 257) after input

I'm assuming it's because of the fields in the header section having a - in the name, but I'm not sure how to handle that. I tried to escape it out, but that cause another issue. Is there another way I should be going about this?

input {
  http_poller {
    urls => {
        urlname => "https://portal.website.test/api"
            {

        url => "https://portal.website.test/api"
        headers => {
          Accept => "application/json"
          Api-Token => "xxxxxxxxxxx"
          Api-Secret => "xxxxxxxxxxx"
                   }
            }
            }
        request_timeout => 60
        schedule => { every => "60s"}
        codec => "json"
              }
}

output {
        elasticsearch {
                hosts => "localhost:9200"
                index => "input_http_poller"
                      }

        stdout {
        codec => rubydebug
                }
}
2

It looks like your error message is truncated.

I do not think there is a "urlname" option, so that would result in an error once the rest of the input configuration is parsed.

You are right that Api-Token is not going to parse as a bareword. You should use "Api-Token".

Try

input {
    http_poller {
        urls => {
            blah => {
                url => "https://portal.website.test/api"
                headers => {
                    "Accept" => "application/json"
                    "Api-Token" => "xxxxxxxxxxx"
                    "Api-Secret" => "xxxxxxxxxxx"
                }
....

The configuration compiler may parse blah as a bareword, but it would be more consistent to use "blah" => {. I have not tested if that works.

3

So I removed the urlname line as I was just following an example I saw someone else use. I also put the Api-Token and Api-Secret in "" but still failing:

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main,
 :exception=>"LogStash::ConfigurationError", :message=>"Expected one of 
[ \\t\\r\\n], \"#\", \"{\" at
 line 13, column 25 (byte 346) after input {\n  http_poller {\n    urls => {\n        url => 
\"https://portal.website.test/api\"\n        headers => {\n          Accept => \"application/json\"\n  
        \"Api-Token\" => \"xxxxxxxxxxx\"\n          \"Api\\-Secret\" => \"xxxxxxxxxxxxxxx\"\n                  
 }   \n            }\n            }  \n        request_timeout ", :backtrace=>["/usr/share/logstash/logstash-
core/lib/logstash/compiler.rb:32:in `compile_imperative'", 
"org/logstash/execution/AbstractPipelineExt.java:189:in `initialize'", 
"org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", 
"/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'",
 "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", 
"/usr/share/logstash/logstash-core/lib/logstash/agent.rb:383:in `block in converge_state'"]}

type or paste
input {
  http_poller {
    urls => {
        url => "https://portal.website.test/api"
        headers => {
          Accept => "application/json"
          "Api-Token" => "xxxxxxxxxxxx"
          "Api-Secret" => "xxxxxxxxxxxxxx"
                   }
            }
            }
        request_timeout => 60
        schedule => { every => "60s"}
        codec => "json"
              }
}

output {
        elasticsearch {
                hosts => "localhost:9200"
                index => "input_http_poller"
                      }

        stdout {
        codec => rubydebug
                }
}
4

Once it is quoted you do not need to escape it, and I think you have a left over } that you should remove.

5

I gave that try, but seems that didn't do it. Also, what extra } do you think I have? I looked and it seems to match up. But I'm a bit of a noob with this, so forgive the ignorance.

[logstash.agent           ] Failed to execute action
 {:action=>LogStash::PipelineAction::Create/pipeline_id:main,
  :exception=>"LogStash::ConfigurationError", 
  :message=>"Expected one of [ \\t\\r\\n], \"#\", \"{\", \"-\",
   [0-9], [A-Za-z_], '\"', \"'\", \"}\" at line 8, column 11 (
   byte 169) after input {\n  http_poller {\n    urls =>
    {\n        url => \"https://portal.website.test/api"\n 
       headers => {\n
          Accept => 
    \"application/json\"\n          ", :backtrace=>["/usr/share/
    logstash/logstash-core/lib/logstash/compiler.rb:32:in 
    `compile_imperative'", "org/logstash/execution/
    AbstractPipelineExt.java:189:in `initialize'", "org/logstash
    /execution/JavaBasePipelineExt.java:72:in `initialize'", 
    "/usr/share/logstash/logstash-core/lib/logstash/
    java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/
    logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", 
"/usr/share/logstash/logstash-core/lib/logstash/
    agent.rb:383:in `block in converge_state'"]}

input {
  http_poller {
    urls => {
        url => "https://portal.website.test/api"
        headers => {
          Accept => "application/json"
        \"Api\\-Secret\" => "xxxxxxxxxxx"
        \"Api\\-Secret\" => "xxxxxxxxxxx"
                   }
            }
            }
        request_timeout => 60
        schedule => { every => "60s"}
        codec => "json"
              }
}

output {
        elasticsearch {
                hosts => "localhost:9200"
                index => "iput_http_poller"
                      }

        stdout {
        codec => rubydebug
                }
}
6

Ok....I see what happened now. I had the brackets in the incorrect place. I fixed that and it's moving past that error now. Thanks for the help.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.