Hello,
today I've installed a new debian-server with logstash 5.6.2 out of the elasticsearch-apt-source.
When I start logstash with debugging-logging, I get following error-message in /var/log/logstash/logstash-plain.log (because of the character-limitation I have shortened the output):
[2017-09-29T13:27:33,926][ERROR][logstash.pipeline ] Error registering plugin {:plugin=>"#<LogStash::OutputDelegator:0x7954ee48 ...... :error=>"HttpClientBuilder not found in packages org.apache.http.client.methods, org.apache.http.client.entity, org.apache.http.client.config, org.apache.http.config, org.apache.http.conn.socket, org.apache.http.impl, org.apache.http.impl.client, org.apache.http.impl.conn, org.apache.http.impl.auth, org.apache.http.entity, org.apache.http.message, org.apache.http.params, org.apache.http.protocol, org.apache.http.auth, java.util.concurrent, org.apache.http.client.protocol, org.apache.http.conn.ssl, java.security.cert, java.security.spec, java.security, org.apache.http.client.utils; last error: cannot load Java class org.apache.http.client.utils.HttpClientBuilder"}
[2017-09-29T13:27:33,934][ERROR][logstash.agent ] Pipeline aborted due to error {:exception=>#<NameError: HttpClientBuilder not found in packages org.apache.http.client.methods, ......]}
[2017-09-29T13:27:36,972][WARN ][logstash.agent ] stopping pipeline {:id=>"main"}
[2017-09-29T13:27:46,500][ERROR][logstash.plugins.registry] Problems loading a plugin with {:type=>"input", :name=>"beats", :path=>"logstash/inputs/beats", :error_message=>"cannot load Java class org.logstash.beats.MessageListener", :error_class=>NameError, ......"/usr/share/logstash/lib/bootstrap/environment.rb:71:in (root)'"]} [2017-09-29T13:27:46,511][ERROR][logstash.agent ] Cannot create pipeline {:reason=>"Couldn't find any input plugin named 'beats'. Are you sure this is correct? Trying to load the beats input plugin resulted in this error: Problems loading the requested plugin named beats of type input. Error: NameError cannot load Java class org.logstash.beats.MessageListener"} [2017-09-29T13:28:05,405][ERROR][logstash.pipeline ] Error registering plugin {:plugin=>"#<LogStash::OutputDelegator:0x2c5a9abe ...<snipped>..., :error=>"cannot load Java class org.apache.http.ConnectionClosedException"} [2017-09-29T13:28:05,415][ERROR][logstash.agent ] Pipeline aborted due to error {:exception=>#<NameError: cannot load Java class org.apache.http.ConnectionClosedException>, :backtrace=>["org/jruby/javasupport/JavaClass.java:204:infor_name'", ...... "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:398:in `start_pipeline'"]}
[2017-09-29T13:28:08,468][WARN ][logstash.agent ] stopping pipeline {:id=>"main"}
[2017-09-29T13:28:17,556][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
[2017-09-29T13:28:17,559][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"}
[2017-09-29T13:28:26,828][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"netflow", :directory=>"/usr/share/logstash/modules/netflow/configuration"}
[2017-09-29T13:28:26,831][INFO ][logstash.modules.scaffold] Initializing module {:module_name=>"fb_apache", :directory=>"/usr/share/logstash/modules/fb_apache/configuration"}
And here is the winlogbeat-logfile-output of one of my Winlogbeat-server which tries to connect to the Logstash-Server:
2017-09-29T13:29:30+02:00 ERR Connecting error publishing events (retrying): dial tcp yyy.yyy.yyy.yyy:5044: connectex: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
2017-09-29T13:29:53+02:00 INFO Non-zero metrics in the last 30s: uptime={"server_time":"2017-09-29T11:29:53.9154549Z","start_time":"2017-09-29T09:56:53.9337395Z","uptime":"1h32m59.9817154s","uptime_ms":"5579981715"}
2017-09-29T13:30:23+02:00 INFO Non-zero metrics in the last 30s: uptime={"server_time":"2017-09-29T11:30:23.9160644Z","start_time":"2017-09-29T09:56:53.9337395Z","uptime":"1h33m29.9823249s","uptime_ms":"5609982324"}
Network-connection between the logstash- and winlogbeat-server is configured properly. Furthermore I can see the connections at the logstash-server at the output from the command "netstat -a".
Can anyone tell me what I have to configure so the winlogbeat-data is processed correctly by the logstash-system?
THX!