Logstash 7.1 configuration file throws error

[vinu89 (vinothine)]

Hi,

I have successfully configured elastic and kibana using SSL/TLS but when it comes to logstash it is throwing me below errrhosts => ["https://*.*.*.*:9200", "https://*.*.*.*:9200"] index => "logstash-bindlive_logs" ssl.certificate_authorities: ["/etc/ca.crt"] ssl.certificate: "/etc/client.crt" ssl.key: "/etc/client.key" user => elastic password => logs@123
Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, } at line 36, column 25 (byte 701) after output {\n if "_grokparsefailure" in [tags] {\n file { path => "/home/faillogs.txt" } }\n else {\n elasticsearch {\n hosts => ["https://:9200", "https://9200"]\n index => "logstash-bindlive_logs"\n user => elastic\n password => dns_logs", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2577:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:ininitialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:inblock in converge_state'"]}
``

[pastechecker (Charlie)]

Hard to tell, you must have some configuration error:

if "_grokparsefailure" in [tags]{
file {
path => "/home/faillogs.txt"
}
}
else {
elasticsearch {
hosts => ["https://:9200", "https://9200"]
index => "logstash-bindlive_logs"
user => elastic
password => dns_logs",

Can you sanitize and paste your output config maybe?

[vinu89 (vinothine)]

output config

hosts => ["https://...:9200", "https://...:9200"]
index => "logstash-bindlive_logs"
ssl.certificate_authorities: ["/etc/ca.crt"]
ssl.certificate: "/etc/client.crt"
ssl.key: "/etc/client.key"
user => elastic
password => logs@123

Error:

Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, } at line 36, column 25 (byte 701) after output {\n if "_grokparsefailure" in [tags] {\n file { path => "/home/faillogs.txt" } }\n else {\n elasticsearch {\n hosts => ["https://:9200", "https://9200"]\n index => "logstash-bindlive_logs"\n user => elastic\n password => logs@123", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2577:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:ininitialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:inblock in converge_state'"]}

[pastechecker (Charlie)]

@pastechecker

password => dns_logs",

Did you terminated the password properly:
password => dns_logs",

? You have double quote at the end of your password and this is where the compilation error starts.

[vinu89 (vinothine)]

i havent used " for username and password field

[pastechecker (Charlie)]

My fault, that was the json error message quoted part.
Did you verified that you have closed the "{" , "}" and double quotations everywhere?

[vinu89 (vinothine)]

yea i have closed it... i am not sure on how to give the ssl fields

[pastechecker (Charlie)]

@vinu89

ssl.certificate_authorities: ["/etc/ca.crt"]
ssl.certificate: "/etc/client.crt"
ssl.key: "/etc/client.key"

The options here:
ssl.certificate_authorities: ["/etc/ca.crt"]
ssl.certificate: "/etc/client.crt"
ssl.key: "/etc/client.key"

are valid for filebeats.
Try to pass to logstash as:

    ssl => true
    ssl_certificate_authorities => ["/etc/ca.crt"]
    ssl_certificate => "/etc/server.crt"
    ssl_key => "/etc/server.key"

[vinu89 (vinothine)]

@pastechecker

ssl => true ssl_certificate_authorities => ["/etc/ca.crt"] ssl_certificate => "/etc/server.crt" ssl_key => "/etc/server.key"

It didnt work

[pastechecker (Charlie)]

If possible, could you please provide your full configuration so we can start recreating the issue?