Logstash 7.1 configuration file throws error

Elastic Stack Logstash
1

Hi,

I have successfully configured elastic and kibana using SSL/TLS but when it comes to logstash it is throwing me below errrhosts => ["https://*.*.*.*:9200", "https://*.*.*.*:9200"] index => "logstash-bindlive_logs" ssl.certificate_authorities: ["/etc/ca.crt"] ssl.certificate: "/etc/client.crt" ssl.key: "/etc/client.key" user => elastic password => logs@123
Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, } at line 36, column 25 (byte 701) after output {\n if "_grokparsefailure" in [tags] {\n file { path => "/home/faillogs.txt" } }\n else {\n elasticsearch {\n hosts => ["https://:9200", "https://9200"]\n index => "logstash-bindlive_logs"\n user => elastic\n password => dns_logs", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2577:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:ininitialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:inblock in converge_state'"]}
``

2

Hard to tell, you must have some configuration error:

if "_grokparsefailure" in [tags]{
file {
path => "/home/faillogs.txt"
}
}
else {
elasticsearch {
hosts => ["https://:9200", "https://9200"]
index => "logstash-bindlive_logs"
user => elastic
password => dns_logs",

Can you sanitize and paste your output config maybe?

3

output config

hosts => ["https://...:9200", "https://...:9200"]
index => "logstash-bindlive_logs"
ssl.certificate_authorities: ["/etc/ca.crt"]
ssl.certificate: "/etc/client.crt"
ssl.key: "/etc/client.key"
user => elastic
password => logs@123

Error:

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, } at line 36, column 25 (byte 701) after output {\n if "_grokparsefailure" in [tags] {\n file { path => "/home/faillogs.txt" } }\n else {\n elasticsearch {\n hosts => ["https://:9200", "https://9200"]\n index => "logstash-bindlive_logs"\n user => elastic\n password => logs@123", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2577:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:ininitialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:inblock in converge_state'"]}

4

Did you terminated the password properly:
password => dns_logs",

? You have double quote at the end of your password and this is where the compilation error starts.

5

i havent used " for username and password field

6

My fault, that was the json error message quoted part.
Did you verified that you have closed the "{" , "}" and double quotations everywhere?

7

yea i have closed it... i am not sure on how to give the ssl fields

8

The options here:
ssl.certificate_authorities: ["/etc/ca.crt"]
ssl.certificate: "/etc/client.crt"
ssl.key: "/etc/client.key"

are valid for filebeats.
Try to pass to logstash as:

    ssl => true
    ssl_certificate_authorities => ["/etc/ca.crt"]
    ssl_certificate => "/etc/server.crt"
    ssl_key => "/etc/server.key"
9

It didnt work

10

If possible, could you please provide your full configuration so we can start recreating the issue?

11

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.