The main issue is that the logstash.yml
already have pipeline.ecs_compatibility: disabled
, but it still not working, so something is not right.
Let's go back a little, are you running Logstash always using the command line or are you also running it as a service?
Your logstash.yml
is pretty normal and has nothing wrong, with pipeline.ecs_compatibility: disabled
you shouldn't get any error like the one you shared.
Can you do the following:
- Stop Logstash.
- Run logstash with the following command line:
/usr/share/logstash/bin/logstash --path.settings /etc/logstash -f /etc/logstash/conf.d/apache.conf
- Share all the logs generated.