Logstash 7 error - ssl trustore path must be string

Elastic Stack Logstash
1

Hi,

i tried to configure logstash nodes.

i followed this document : https://www.elastic.co/guide/en/logstash/current/configuring-logstash.html

i copied the ca.p12 cert from elasticsearch cluster nodes.

my logstash.yml file:

xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: elastic
xpack.monitoring.elasticsearch.password: elastic
xpack.monitoring.elasticsearch.hosts: ["http://192.168.136.x:9200", "http://192.168.136.x:9200"]
xpack.monitoring.elasticsearch.sniffing: false
xpack.monitoring.elasticsearch.ssl.truststore.path: [ "/home/harry/ca.p12" ]

xpack.management.enabled: true
xpack.management.elasticsearch.username: elastic
xpack.management.elasticsearch.password: elastic
xpack.management.elasticsearch.hosts: ["http://192.168.136.x:9200", "http://192.168.136.x:9200"]
xpack.management.pipeline.id: ["mainpipe"]

my logstash.conf file:

input {
file {
path => "/home/harry/DAILYDATA_S24_201904.csv"
start_position => beginning

}

}

filter {
csv {
columns => [
"Daily Rainfall Total",
"Highest 30 Min Rainfall",
"Highest 60 Min Rainfall",
"Highest 120 Min Rainfal",
"Mean Temperature",
"Maximum Temperature",
"Minimum Temperature",
"Mean Wind Speed",
"Max Wind Speed"
]
separator => ","
remove_field => ["message"]
}
date {
match => ["time", "ISO8601"]
}
mutate {
convert => ["TempOut", "float"]
}
}

output {
elasticsearch {
hosts => ["http://192.168.136.x:9200" , "http://192.168.136.x:9200"]
user => "elastic"
password => "elastic"
action => "index"
index => "weather_index"
}
stdout { }
}

restarted logstash service, shows below error:

logstash logs:

[2019-05-22T01:30:11,707][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

[2019-05-22T01:31:21,565][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<ArgumentError: Setting "xpack.monitoring.elasticsearch.ssl.truststore.path" must be a String. Received: ["/home/hari/ca.p12"] (Array)>, :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/settings.rb:235:in validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:411:invalidate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:421:in validate'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:198:inset'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:69:in set_value'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:88:inblock in merge'", "org/jruby/RubyHash.java:1419:in each'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:88:inmerge'", "/usr/share/logstash/logstash-core/lib/logstash/settings.rb:137:in validate_all'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:278:inexecute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:in run'", "/usr/share/logstash/logstash-core/lib/logstash/runner.rb:237:inrun'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:in run'", "/usr/share/logstash/lib/bootstrap/environment.rb:73:in'"]}
[2019-05-22T01:31:21,606][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

please guide me where i make wrong....

thanks

Harry

2

That should be a string, not an array of strings.

1 Like
3

Hi

thanks , i have cleared that error.

my logstash.yml file

xpack.monitoring.enabled: true
xpack.monitoring.elasticsearch.username: elastic
xpack.monitoring.elasticsearch.password: elastic
xpack.monitoring.elasticsearch.hosts: ["http://192.168.x.x:9200', "http://192.168.x.x:9200"]
xpack.monitoring.elasticsearch.sniffing: false
xpack.monitoring.elasticsearch.ssl.truststore.path: "/etc/logstash/certs/ca/ca.p12"
xpack.monitoring.elasticsearch.ssl.certificate_authority: "/etc/logstash/certs/logstash/logstash.p12"
xpack.monitoring.elasticsearch.ssl.verification_mode: certificate

xpack.management.enabled: true
xpack.management.elasticsearch.username: elastic
xpack.management.elasticsearch.password: elastic
xpack.management.elasticsearch.hosts: ["http://192.168.136.159:9200", "http://192.168.136.160:9200"]
xpack.management.pipeline.id: ["mainpipe"]

/etc/logstash/conf.d/logstash.conf file:

input {
file {
path => "/home/hari/DAILYDATA_S24_201904.csv"
start_position => beginning

}

}

filter {
csv {
columns => [
"Daily Rainfall Total",
"Highest 30 Min Rainfall",
"Highest 60 Min Rainfall",
"Highest 120 Min Rainfal",
"Mean Temperature",
"Maximum Temperature",
"Minimum Temperature",
"Mean Wind Speed",
"Max Wind Speed"
]
separator => ","
remove_field => ["message"]
}
date {
match => ["time", "ISO8601"]
}
mutate {
convert => ["TempOut", "float"]
}
}

output {
elasticsearch {
hosts => "http://192.168.x.x:9200" , "http://192.168.x.x:9200"
user => "elastic"
password => "elastic"
action => "index"
index => "weather_index"
}
stdout { }
}

logstash logs shows below error:

[2019-05-22T07:36:39,386][INFO ][logstash.configmanagement.bootstrapcheck] Using Elasticsearch as config store {:pipeline_id=>["mainpipe"], :poll_interval=>"5000000000 ns"}
[2019-05-22T07:36:40,910][ERROR][logstash.licensechecker.licensereader] Unable to retrieve license information from license server {:message=>"Explicit value for 'sche me' was declared, but it is different in one of the URLs given! Please make sure your URLs are inline with explicit values. The URLs have the property set to 'http', b ut it was also set to 'https' explicitly"}
[2019-05-22T07:36:41,121][ERROR][logstash.configmanagement.elasticsearchsource] Failed to fetch X-Pack information from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.
[2019-05-22T07:36:41,134][FATAL][logstash.runner ] An unexpected error occurred! {:error=>#<LogStash::LicenseChecker::LicenseError: Failed to fetch X-Pack inf ormation from Elasticsearch. This is likely due to failure to reach a live Elasticsearch cluster.>, :backtrace=>["/usr/share/logstash/x-pack/lib/license_checker/licens ed.rb:67:in with_license_check'", "/usr/share/logstash/x-pack/lib/config_management/elasticsearch_source.rb:45:ininitialize'", "/usr/share/logstash/x-pack/lib/confi g_management/hooks.rb:41:in after_bootstrap_checks'", "org/logstash/execution/EventDispatcherExt.java:71:inexecute'", "/usr/share/logstash/logstash-core/lib/logstas h/runner.rb:293:in execute'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:67:inrun'", "/usr/share/logstash/logstash-core/li b/logstash/runner.rb:237:in run'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/clamp-0.6.5/lib/clamp/command.rb:132:inrun'", "/usr/share/logstash/lib/bootst rap/environment.rb:73:in `'"]}
[2019-05-22T07:36:41,187][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

i tried to run "bin/logstash -f /etc/logstash/conf.d/logstash.conf"

[root@logstash logstash]# bin/logstash -f /etc/logstash/conf.d/logstash.conf
OpenJDK 64-Bit Server VM warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads appropriately using -XX:ParallelGCThreads=N
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[WARN ] 2019-05-22 08:06:17.584 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2019-05-22 08:06:17.696 [LogStash::Runner] runner - Starting Logstash {"logstash.version"=>"7.1.0"}
[ERROR] 2019-05-22 08:06:22.966 [Converge PipelineAction::Create] agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of #, {, ", ', } at line 35, column 48 (byte 730) after output {\n elasticsearch {\n hosts => "http://192.168.136.159:9200" ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:incompile_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in block in compile_sources'", "org/jruby/RubyArray.java:2577:inmap'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:ininitialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:inblock in converge_state'"]}
[INFO ] 2019-05-22 08:06:23.941 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[INFO ] 2019-05-22 08:06:28.541 [LogStash::Runner] runner - Logstash shut down.
[root@logstash logstash]#

where i am doing mistake, can help me out...

Thanks
Harry

4

You have told xpack to use certificate authentication, but also (in xpack.monitoring.elasticsearch.hosts) told it to use http. That's a conflict.

Also,

hosts => "http://192.168.x.x:9200/" , "http://192.168.x.x:9200/"

should be

hosts => [ "http://192.168.x.x:9200/" , "http://192.168.x.x:9200/" ]
5

thanks , it works... could see my index

curl -u elastic http://192.168.136.159:9200/_cat/indices

Enter host password for user 'elastic':
green open .security-7 koLuoo-jRqa-j8XN1n5xyg 1 1 11 2 65.7kb 32.8kb
green open weather_index Noqkc3wzQwyC2iuiq4gGSA 1 1 31 0 56.7kb 34.6kb
green open .kibana_task_manager 4YNGPwSQTkalbAd_DZOIoA 1 1 2 0 25.6kb 12.8kb
green open .kibana_1 xRQr4zSdSx2H3v392hNGqA 1 1 3 0 14.1kb 7kb
green open .tasks HM5IOAj4TH63VIygboUXjw 1 1 1 0 12.7kb 6.3kb
green open .logstash U9OiOrprR5a46Ed6NdjqGA 1 1 1 0 9.7kb 4.8kb
green open .kibana_2 n02ZdJsbQKGG4QT6M9F_cw 1 1 5 2 69.7kb 34.8kb

i added below lines in logstash.yml file - is that needed?

xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: /etc/logstash/certs/logstash/logstash.p12
xpack.security.http.ssl.truststore.path: /etc/logstash/certs/ca/ca.p12

please let me know...

thanks
harry

6

Hi

My logstash service is running ... but log file is not updating ...

showing past messages...

i tried to restart logstash service twice but not updating in the logs.

any reason ... even i killed the processes also. but still the same.

[root@logstash ~]# systemctl status logstash
● logstash.service - logstash
Loaded: loaded (/etc/systemd/system/logstash.service; enabled; vendor preset: disabled)
Active: active (running) since Wed 2019-05-22 09:05:32 SGT; 40s ago
Main PID: 2858 (java)
CGroup: /system.slice/logstash.service
└─2858 /bin/java -Xms1g -Xmx1g -XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -Djava.awt.headless=true ...

May 22 09:05:32 logstash systemd[1]: logstash.service holdoff time over, scheduling restart.
May 22 09:05:32 logstash systemd[1]: Started logstash.
May 22 09:05:32 logstash systemd[1]: Starting logstash...
May 22 09:05:32 logstash logstash[2858]: OpenJDK 64-Bit Server VM warning: If the number of processors is expected to increase from one, then you should c...CThreads=N
Hint: Some lines were ellipsized, use -l to show in full.

Thanks
Harry

7

Badger:

i added below lines in logstash.yml file - is that needed?

xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: /etc/logstash/certs/logstash/logstash.p12
xpack.security.http.ssl.truststore.path: /etc/logstash/certs/ca/ca.p12

please let me know...

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.