# Logstash 5.6.3 setup with Filebeat and Kibana on CentOS 7

**URL:** https://discuss.elastic.co/t/logstash-5-6-3-setup-with-filebeat-and-kibana-on-centos-7/104568
**Category:** Logstash
**Created:** [October 19, 2017, 1:58pm UTC](https://discuss.elastic.co/t/logstash-5-6-3-setup-with-filebeat-and-kibana-on-centos-7/104568 "2017-10-19T13:58:04Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Jens\_van\_der\_Wateren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jens_van_der_wateren/32/23192_2.png) [@Jens\_van\_der\_Wateren](https://discuss.elastic.co/u/Jens_van_der_Wateren)
#### Post date: [October 19, 2017, 1:58pm UTC](https://discuss.elastic.co/t/logstash-5-6-3-setup-with-filebeat-and-kibana-on-centos-7/104568/1 "2017-10-19T13:58:04Z")

</div>

I've been trying to experiment with Elasticsearch and the Elastic Cloud because I might want to use it for the company I currently work for. I have a 2 week trial, but I'm afraid I've not yet come very far because I cannot manage to get Logstash running without issues. This is my logstash.yml (mostly just default settings):

[Pastebin logstash.yml](https://pastebin.com/J5ZGWuvP)

I want to use Filebeat to send apache logs realtime to the Elastic Cloud so I can analyze them. My logstash.conf looks like this:

> **Summary**
>
> input {  
> beats {  
> host =\> "127.0.0.1"  
> port =\> 5044  
> }  
> }
> 
> # The filter part of this file is commented out to indicate that it is
> 
> # optional.
> 
> # filter {
> 
> # 
> 
> # }
> 
> output {  
> elasticsearch {  
> hosts =\> ["[https://749ef3120c86cdbf58c4c002f2344b86.eu-west-1.aws.found.io:9243](https://749ef3120c86cdbf58c4c002f2344b86.eu-west-1.aws.found.io:9243)"]  
> user =\> "Jens"  
> password =\> "pass"  
> manage\_template =\> false  
> index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
> document\_type =\> "%{[@metadata][type]}"  
> }  
> }

The pipeline is never actually created. Below is the error which I think is causing all this trouble, but I have honestly no idea how to fix it (or what the cause is).

> **Summary**
>
> [2017-10-19T15:05:35,247][ERROR][logstash.pipeline] Error registering plugin {:plugin=\>"#\<LogStash::OutputDelegator:0x2d46745c @namespaced\_metric=#\<LogStash::Instrument::NamespacedMetric:0x3fb113ac @metric=#\<LogStash::Instrument::Metric:0x39c77192 @collector=#\<LogStash::Instrument::Collector:0x5a4ad3ea @agent=nil, @metric\_store=#\<LogStash::Instrument::MetricStore:0x4430a86b @store=#\<Concurrent:🗺0x000000000644a8 entries=3 default\_proc=nil\>, @structured\_lookup\_mutex=#Mutex:0x732bef32, @fast\_lookup=#\<Concurrent:🗺0x000000000644ac entries=61 default\_proc=nil\>\>\>\>, @namespace\_name=[:stats, :pipelines, :main, :plugins, :outputs, :"8f2791f16b92257ba930f259763a80cdb7570108-2"]\>, @metric=#\<LogStash::Instrument::NamespacedMetric:0x7dbb1361 @metric=#\<LogStash::Instrument::Metric:0x39c77192 @collector=#\<LogStash::Instrument::Collector:0x5a4ad3ea @agent=nil, @metric\_store=#\<LogStash::Instrument::MetricStore:0x4430a86b @store=#\<Concurrent:🗺0x000000000644a8 entries=3 default\_proc=nil\>, @structured\_lookup\_mutex=#Mutex:0x732bef32, @fast\_lookup=#\<Concurrent:🗺0x000000000644ac entries=61 default\_proc=nil\>\>\>\>, @namespace\_name=[:stats, :pipelines, :main, :plugins, :outputs]\>, @logger=#\<LogStash::Logging::Logger:0x1077b591 @logger=#Java::OrgApacheLoggingLog4jCore::Logger:0x24b8860e\>, @out\_counter=LogStash::Instrument::MetricType::Counter - namespaces: [:stats, :pipelines, :main, :plugins, :outputs, :"8f2791f16b92257ba930f259763a80cdb7570108-2", :events] key: out value: 0, @in\_counter=LogStash::Instrument::MetricType::Counter - namespaces: [:stats, :pipelines, :main, :plugins, :outputs, :"8f2791f16b92257ba930f259763a80cdb7570108-2", :events] key: in value: 0, @strategy=#\<LogStash::OutputDelegatorStrategies::Shared:0x26295cb0 @output=\<LogStash::Outputs::ElasticSearch hosts=\>[[https://749ef3120c86cdbf58c4c002f2344b86.eu-west-1.aws.found.io:9243](https://749ef3120c86cdbf58c4c002f2344b86.eu-west-1.aws.found.io:9243)], user=\>"Jens", password=\>, manage\_template=\>false, index=\>"%{[@metadata][beat]}-%{+YYYY.MM.dd}", document\_type=\>"%{[@metadata][type]}", id=\>"8f2791f16b92257ba930f259763a80cdb7570108-2", enable\_metric=\>true, codec=\>\<LogStash::Codecs::Plain id=\>"plain\_ac1228ed-ffe4-4565-aa96-c38800fd7d43", enable\_metric=\>true, charset=\>"UTF-8"\>, workers=\>1, template\_name=\>"logstash", template\_overwrite=\>false, idle\_flush\_time=\>1, doc\_as\_upsert=\>false, script\_type=\>"inline", script\_lang=\>"painless", script\_var\_name=\>"event", scripted\_upsert=\>false, retry\_initial\_interval=\>2, retry\_max\_interval=\>64, retry\_on\_conflict=\>1, action=\>"index", ssl\_certificate\_verification=\>true, sniffing=\>false, sniffing\_delay=\>5, timeout=\>60, pool\_max=\>1000, pool\_max\_per\_route=\>100, resurrect\_delay=\>5, validate\_after\_inactivity=\>10000, http\_compression=\>false, ssl=\>true\>\>, @id="8f2791f16b92257ba930f259763a80cdb7570108-2", @time\_metric=LogStash::Instrument::MetricType::Counter - namespaces: [:stats, :pipelines, :main, :plugins, :outputs, :"8f2791f16b92257ba930f259763a80cdb7570108-2", :events] key: duration\_in\_millis value: 0, @metric\_events=#\<LogStash::Instrument::NamespacedMetric:0xb5fbed9 @metric=#\<LogStash::Instrument::Metric:0x39c77192 @collector=#\<LogStash::Instrument::Collector:0x5a4ad3ea @agent=nil, @metric\_store=#\<LogStash::Instrument::MetricStore:0x4430a86b @store=#\<Concurrent:🗺0x000000000644a8 entries=3 default\_proc=nil\>, @structured\_lookup\_mutex=#Mutex:0x732bef32, @fast\_lookup=#\<Concurrent:🗺0x000000000644ac entries=61 default\_proc=nil\>\>\>\>, @namespace\_name=[:stats, :pipelines, :main, :plugins, :outputs, :"8f2791f16b92257ba930f259763a80cdb7570108-2", :events]\>, @output\_class=LogStash::Outputs::ElasticSearch\>", :error=\>"Unexpected character ('\<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')\n at [Source: (byte[])""; line: 1, column: 2]"}  
> [2017-10-19T15:05:35,254][ERROR][logstash.agent] Pipeline aborted due to error {:exception=\>#\<LogStash::Json::ParserError: Unexpected character ('\<' (code 60)): expected a valid value (number, String, array, object, 'true', 'false' or 'null')

This line comes from my logstash-plain.log - the following is what happens over and over again because Logstash is trying to start again after it has stopped.

The entire log file can be visited here: [logstash-plain.log](https://pastebin.com/EDRcz6Kw)

I'm entirely out of ideas. I've looked at the documentation, Googled the error messages... I have no clue why it's not working.

Thanks in advance 🙂

Jens

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 16, 2017, 1:59pm UTC](https://discuss.elastic.co/t/logstash-5-6-3-setup-with-filebeat-and-kibana-on-centos-7/104568/2 "2017-11-16T13:59:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.