Logstash 7.1 configuration file throws error

Elastic Stack Logstash
1

Hi,

I have successfully configured elastic and kibana using SSL/TLS but when it comes to logstash it is throwing me below errrhosts => ["https://*.*.*.*:9200", "https://*.*.*.*:9200"] index => "logstash-bindlive_logs" ssl.certificate_authorities: ["/etc/ca.crt"] ssl.certificate: "/etc/client.crt" ssl.key: "/etc/client.key" user => elastic password => logs@123
Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, } at line 36, column 25 (byte 701) after output {\n if "_grokparsefailure" in [tags] {\n file { path => "/home/faillogs.txt" } }\n else {\n elasticsearch {\n hosts => ["https://:9200", "https://9200"]\n index => "logstash-bindlive_logs"\n user => elastic\n password => dns_logs", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2577:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:ininitialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:inblock in converge_state'"]}
``

2

Hard to tell, you must have some configuration error:

if "_grokparsefailure" in [tags]{
file {
path => "/home/faillogs.txt"
}
}
else {
elasticsearch {
hosts => ["https://:9200", "https://9200"]
index => "logstash-bindlive_logs"
user => elastic
password => dns_logs",

Can you sanitize and paste your output config maybe?

3

output config

hosts => ["https://...:9200", "https://...:9200"]
index => "logstash-bindlive_logs"
ssl.certificate_authorities: ["/etc/ca.crt"]
ssl.certificate: "/etc/client.crt"
ssl.key: "/etc/client.key"
user => elastic
password => logs@123

Error:

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, } at line 36, column 25 (byte 701) after output {\n if "_grokparsefailure" in [tags] {\n file { path => "/home/faillogs.txt" } }\n else {\n elasticsearch {\n hosts => ["https://:9200", "https://9200"]\n index => "logstash-bindlive_logs"\n user => elastic\n password => logs@123", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2577:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:ininitialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:inblock in converge_state'"]}

4

Did you terminated the password properly:
password => dns_logs",

? You have double quote at the end of your password and this is where the compilation error starts.

5

i havent used " for username and password field

6

My fault, that was the json error message quoted part.
Did you verified that you have closed the "{" , "}" and double quotations everywhere?

7

yea i have closed it... i am not sure on how to give the ssl fields

8

The options here:
ssl.certificate_authorities: ["/etc/ca.crt"]
ssl.certificate: "/etc/client.crt"
ssl.key: "/etc/client.key"

are valid for filebeats.
Try to pass to logstash as:

    ssl => true
    ssl_certificate_authorities => ["/etc/ca.crt"]
    ssl_certificate => "/etc/server.crt"
    ssl_key => "/etc/server.key"
9

It didnt work

10

If possible, could you please provide your full configuration so we can start recreating the issue?