Logstash cannot open file located in /etc/logstash

Elastic Stack Logstash
1

I am trying (for the first time) to get an instance of logstash (running on ubuntu) to connect with my secured cluster.
I am confused a bit on the security certificate formats but I am receiving this error so I am working through each error as it comes.

   Jan 03 11:45:36 servername logstash[28352]: [2019-01-03T11:45:36,103][ERROR][logstash.outputs.elasticsearch] Invalid setting for elasticsearch output plugin:

Jan 03 11:45:36 servername logstash[28352]: output {
Jan 03 11:45:36 servername logstash[28352]: elasticsearch {
Jan 03 11:45:36 servername logstash[28352]: # This setting must be a path
Jan 03 11:45:36 servername logstash[28352]: # File does not exist or cannot be opened /etc/logstash/config/certs/instance.crt
Jan 03 11:45:36 servername logstash[28352]: cacert => "/etc/logstash/config/certs/instance.crt"
Jan 03 11:45:36 servername logstash[28352]: ...
Jan 03 11:45:36 servername logstash[28352]: }
Jan 03 11:45:36 servername logstash[28352]: }

Any help or hints would be welcome.

Thanks for the support.

2

Have you checked the ACL for the file? Check what user runs the logstash process and make sure that user can read the file.

3

Thanks for the reply, I did and that was confusing. Am I wrong or does elasticsearch and kibana expect the config file under /etc/application/config? and logstash only works if its in /usr/share/application/config? One other thing I did was a made sure all the logstash plugins were updated. I had updated logstash and apparently that update does not check if the modules are compatible, (bug)?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.