LogStash::ConfigurationError", :message=>"Expected one of [A-Za-z0-9_-]

muthug · February 15, 2021, 1:11pm

Hi Guys,

Good Day!!

I am facing the issue while staring the logstash.

LogStash::ConfigurationError", :message=>"Expected one of [A-Za-z0-9_-] [ \t\r\n], "#", "{", [A-Za-z0-9_], "}" at line 49, column 31 (byte 1290) after output {\n if "total" in [tags] {\n elasticsearch {\n index => ["totalexecution_%{indexName}_%{+YYYY}"]\n hosts => ["https://ip:9200", "https://ip:9200", "https://ip:9200"]\n user => elastic\n password => Global", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:183:in initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:44:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:357:in block in converge_state'"]}

' 1 input {
2 beats {
3 port => "5044"
4 }
5 }
6
7
8 filter {
9 grok {
10 match => {"message" => "%{LOGLEVEL:loglevel} %{NUMBER:tenantId} %{NUMBER:organizationUnitId} %{GREEDYDATA:message}"}
11 overwrite => ["message"]
12 }
13 json {
14 source => "message"
15 }
16
17 if [message] != "" {
18 if "execution ended" in [message] {
19 mutate { add_tag => ["total"] }
20 }
21 if "Info" in [level] or "Warn" in [level] or "Error" in [level] or "Fatal" in [level] {
22 mutate { add_tag => ["default"] }
23 }
24 else {
25 drop {}
26 }
27 }
28 else {
29 if "management_" in [indexName] {
30 mutate { add_tag => ["management"] }
31 }
32 else if "environmentcheck_" in [indexName] {
33 mutate { add_tag => ["environmentcheck"] }
34 }
35 else {
36 mutate { add_tag => ["robotic"] }
37 }
38 }
39 ruby { path => "/etc/logstash/ruby_scripts/index_name_script.rb" }
40 }
43 output {
44 if "total" in [tags] {
45 elasticsearch {
46 index => ["totalexecution_%{indexName}%{+YYYY}"]
47 hosts => ["https://ip:9200", "https://ip:9200", "https://ip:9200"]
48 user => elastic
49 password => Changeme@123
50 ssl => true
51 cacert => "/etc/logstash/elasticsearch-ca.pem"
52 }
53 }
54 if "default" in [tags] {
55 elasticsearch {
56 index => ["default%{indexName}%{+YYYY}"]
57 hosts => ["https://ip:9200", "https://ip:9200", "https://ip:9200"]
58 user => elastic
59 password => Changeme@123
60 ssl => true
61 cacert => "/etc/logstash/elasticsearch-ca.pem"
62 }
63 }
64 if "management" in [tags] {
65 elasticsearch {
66 index => ["management%{indexName}%{+YYYY.MM}"]
67 hosts => [""https://ip:9200", "https://ip:9200", "https://ip:9200"]
68 user => elastic
69 password => Changeme@123
70 ssl => true
71 cacert => "/etc/logstash/elasticsearch-ca.pem"
72 }
73 }
74 if "robotic" in [tags] {
75 elasticsearch {
76 index => ["robot%{indexName}%{+YYYY.MM}"]
77 hosts => ["https://ip:9200", "https://ip:9200", "https://ip:9200"]
78 user => elastic
79 password => Changeme@123
80 ssl => true
81 cacert => "/etc/logstash/elasticsearch-ca.pem"
82 }
83 }
84 if "environmentcheck" in [tags] {
85 elasticsearch {
86 index => ["environmentcheck%{indexName}_%{+YYYY}"]
87 hosts => ["https://ip:9200", "https://ip:9200", "https://ip:9200" ]
88 user => elastic
89 password => Changeme@123
90 ssl => true
91 cacert => "/etc/logstash/elasticsearch-ca.pem"
92 }
93 }
94 }`

muthug · February 15, 2021, 1:28pm

line 49 and column 31 is referring special characters. Do we not use special characters in password?

Badger · February 15, 2021, 5:23pm

You need to put quotes around the password.

muthug · February 15, 2021, 5:25pm

Thanks for your reply @Badger

I did that. But now i am getting this error now.

==> /var/log/logstash/logstash-plain.log <==
[2021-02-15T18:20:32,308][INFO ][logstash.runner ] Logstash shut down.
[2021-02-15T18:20:32,343][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[2021-02-15T18:21:05,877][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.9.1", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc Java HotSpot(TM) 64-Bit Server VM 25.202-b08 on 1.8.0_202-b08 +indy +jit [linux-x86_64]"}
[2021-02-15T18:21:06,947][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2021-02-15T18:21:12,986][INFO ][org.reflections.Reflections] Reflections took 176 ms to scan 1 urls, producing 22 keys and 45 values
[2021-02-15T18:21:13,956][INFO ][logstash.filters.ruby.script] Test run complete {:script_path=>"/etc/logstash/ruby_scripts/index_name_script.rb", :results=>{:passed=>0, :failed=>0, :errored=>0}}
[2021-02-15T18:21:15,231][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil}
[2021-02-15T18:21:15,763][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2021-02-15T18:21:20,567][INFO ][logstash.runner ] Logstash shut down.
[2021-02-15T18:21:20,652][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

Badger · February 15, 2021, 5:27pm

I suggest you enable log.level debug and see if you get a more informative error message.

muthug · February 15, 2021, 5:31pm

you mean this "bin/logstash -f /etc/logstash/ --log.level debu" ?

muthug · February 15, 2021, 5:46pm

Where i can share the logs its too big and i coundn't find any thing

muthug · February 15, 2021, 6:07pm

https://gist.github.com/muthug91/d9e898d3880bfb4073c06d053e6212b0

I have attached the log.level --debug

i am unable to find any thing kindly help

Badger · February 15, 2021, 6:35pm

There is nothing there that indicates what the error is because the error did not occur. logstash successfully started and then

^C[WARN ] 2021-02-15 18:33:17.143 [SIGINT handler] runner - SIGINT received. Shutting down.

you killed it.

muthug · February 15, 2021, 6:39pm

You are right, i stopped it because it looks looped by below message.

[DEBUG] 2021-02-15 19:39:55.499 [pool-6-thread-1] jvm - collector name {:name=>"ParNew"}
[DEBUG] 2021-02-15 19:39:55.499 [pool-6-thread-1] jvm - collector name {:name=>"ConcurrentMarkSweep"}
[DEBUG] 2021-02-15 19:39:57.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.
[DEBUG] 2021-02-15 19:40:00.504 [pool-6-thread-1] jvm - collector name {:name=>"ParNew"}
[DEBUG] 2021-02-15 19:40:00.504 [pool-6-thread-1] jvm - collector name {:name=>"ConcurrentMarkSweep"}
[DEBUG] 2021-02-15 19:40:02.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.
[DEBUG] 2021-02-15 19:40:05.509 [pool-6-thread-1] jvm - collector name {:name=>"ParNew"}
[DEBUG] 2021-02-15 19:40:05.510 [pool-6-thread-1] jvm - collector name {:name=>"ConcurrentMarkSweep"}
[DEBUG] 2021-02-15 19:40:07.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.
[DEBUG] 2021-02-15 19:40:10.518 [pool-5-thread-1] jvm - collector name {:name=>"ParNew"}
[DEBUG] 2021-02-15 19:40:10.519 [pool-5-thread-1] jvm - collector name {:name=>"ConcurrentMarkSweep"}
[DEBUG] 2021-02-15 19:40:12.911 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.
[DEBUG] 2021-02-15 19:40:15.524 [pool-5-thread-1] jvm - collector name {:name=>"ParNew"}
[DEBUG] 2021-02-15 19:40:15.524 [pool-5-thread-1] jvm - collector name {:name=>"ConcurrentMarkSweep"}
[DEBUG] 2021-02-15 19:40:17.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.
[DEBUG] 2021-02-15 19:40:20.529 [pool-6-thread-1] jvm - collector name {:name=>"ParNew"}
[DEBUG] 2021-02-15 19:40:20.529 [pool-6-thread-1] jvm - collector name {:name=>"ConcurrentMarkSweep"}
[DEBUG] 2021-02-15 19:40:22.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.
[DEBUG] 2021-02-15 19:40:25.534 [pool-5-thread-1] jvm - collector name {:name=>"ParNew"}
[DEBUG] 2021-02-15 19:40:25.534 [pool-5-thread-1] jvm - collector name {:name=>"ConcurrentMarkSweep"}
[DEBUG] 2021-02-15 19:40:27.911 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.
[DEBUG] 2021-02-15 19:40:30.552 [pool-5-thread-1] jvm - collector name {:name=>"ParNew"}
[DEBUG] 2021-02-15 19:40:30.552 [pool-5-thread-1] jvm - collector name {:name=>"ConcurrentMarkSweep"}
[DEBUG] 2021-02-15 19:40:32.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.
[DEBUG] 2021-02-15 19:40:35.556 [pool-6-thread-1] jvm - collector name {:name=>"ParNew"}
[DEBUG] 2021-02-15 19:40:35.557 [pool-6-thread-1] jvm - collector name {:name=>"ConcurrentMarkSweep"}
[DEBUG] 2021-02-15 19:40:37.911 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.
[DEBUG] 2021-02-15 19:40:40.563 [pool-6-thread-1] jvm - collector name {:name=>"ParNew"}
[DEBUG] 2021-02-15 19:40:40.563 [pool-6-thread-1] jvm - collector name {:name=>"ConcurrentMarkSweep"}
[DEBUG] 2021-02-15 19:40:42.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.
[DEBUG] 2021-02-15 19:40:45.567 [pool-6-thread-1] jvm - collector name {:name=>"ParNew"}
[DEBUG] 2021-02-15 19:40:45.568 [pool-6-thread-1] jvm - collector name {:name=>"ConcurrentMarkSweep"}
[DEBUG] 2021-02-15 19:40:47.911 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.
[DEBUG] 2021-02-15 19:40:50.573 [pool-6-thread-1] jvm - collector name {:name=>"ParNew"}
[DEBUG] 2021-02-15 19:40:50.573 [pool-6-thread-1] jvm - collector name {:name=>"ConcurrentMarkSweep"}
[DEBUG] 2021-02-15 19:40:52.910 [logstash-pipeline-flush] PeriodicFlush - Pushing flush onto pipeline.
[DEBUG] 2021-02-15 19:40:55.580 [pool-6-thread-1] jvm - collector name {:name=>"ParNew"}
[DEBUG] 2021-02-15 19:40:55.581 [pool-6-thread-1] jvm - collector name {:name=>"ConcurrentMarkSweep"}

Note:- It is new configuration, there is no data. Once i enabled xpack security in ES, i am unable to start logstash and getting below error

[2021-02-15T18:20:32,343][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit
[2021-02-15T18:21:05,877][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.9.1", "jruby.version"=>"jruby 9.2.13.0 (2.5.7) 2020-08-03 9a89c94bcc Java HotSpot(TM) 64-Bit Server VM 25.202-b08 on 1.8.0_202-b08 +indy +jit [linux-x86_64]"}
[2021-02-15T18:21:06,947][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2021-02-15T18:21:12,986][INFO ][org.reflections.Reflections] Reflections took 176 ms to scan 1 urls, producing 22 keys and 45 values
[2021-02-15T18:21:13,956][INFO ][logstash.filters.ruby.script] Test run complete {:script_path=>"/etc/logstash/ruby_scripts/index_name_script.rb", :results=>{:passed=>0, :failed=>0, :errored=>0}}
[2021-02-15T18:21:15,231][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil}
[2021-02-15T18:21:15,763][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2021-02-15T18:21:20,567][INFO ][logstash.runner ] Logstash shut down.
[2021-02-15T18:21:20,652][ERROR][org.logstash.Logstash ] java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit

Badger · February 15, 2021, 6:43pm

So enable log.level debug when you have x-pack security enabled. Look particularly for certificate related debug messages.

muthug · February 15, 2021, 6:46pm

Kindly help how to do that?

muthug · February 15, 2021, 7:02pm

anything you can able to help here ?

Badger · February 15, 2021, 7:57pm

You were able to enable log.level debug before and posted the results. Do that again when x-pack security is enabled.

muthug · February 16, 2021, 3:21am

The provide log.level debug was took while xpack security is enabled

Badger · February 16, 2021, 3:27am

You are telling us that sometimes that produces

[2021-02-15T18:21:15,231][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create, action_result: false", :backtrace=>nil}

and sometimes it produces

[INFO ] 2021-02-15 18:32:00.190 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=>"main"}
[DEBUG] 2021-02-15 18:32:00.196 [Converge PipelineAction::Create<main>] javapipeline - Pipeline started successfully {:pipeline_id=>"main", :thread=>"#<Thread:0x342a6c6e run>"}

That seems unlikely if you are running the same configuration in both cases.

system · March 16, 2021, 3:27am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.