Hi there, I am new ELK and having some trouble configuring Logstash.
I tried to follow this tutorial
the config file is as follows.
input {
jdbc {
jdbc_connection_string => "jdbc:mysql://localhost/telecom1"
# The user we wish to execute our statement as
jdbc_user => "xxxxx"
jdbc_password => "xxxxx"
# The path to our downloaded jdbc driver
jdbc_driver_library => "/usr/share/java/mysql-connector-java-8.0.16.jar"
jdbc_driver_class => "com.mysql.jdbc.Driver"
# our query
statement => "SELECT * FROM state_quality"
}
}
output {
stdout { codec => json_lines }
elasticsearch {
"hosts" => "localhost:9200"
"index" => "state_index"
"document_type" => "data"
}
}
after /usr/share/logstash# bin/logstash -f logstash.config
I am getting the below warnings and errors.
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Sending Logstash logs to /usr/share/logstash/logs which is now configured via log4j2.properties
[2019-06-20T10:21:34,028][WARN ][logstash.config.source.multilocal] Ignoring the 'pipelines.yml' file because modules or command line options are specified
[2019-06-20T10:21:34,063][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.1.1"}
[2019-06-20T10:21:42,618][ERROR][logstash.outputs.elasticsearch] Unknown setting '"document_type"' for elasticsearch
[2019-06-20T10:21:42,626][ERROR][logstash.outputs.elasticsearch] Unknown setting '"hosts"' for elasticsearch
[2019-06-20T10:21:42,626][ERROR][logstash.outputs.elasticsearch] Unknown setting '"index"' for elasticsearch
[2019-06-20T10:21:42,636][ERROR][logstash.agent ] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Something is wrong with your configuration.", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/config/mixin.rb:86:in config_init'", "/usr/share/logstash/logstash-core/lib/logstash/outputs/base.rb:60:ininitialize'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:232:in initialize'", "org/logstash/config/ir/compiler/OutputDelegatorExt.java:48:ininitialize'", "org/logstash/config/ir/compiler/OutputDelegatorExt.java:30:in initialize'", "org/logstash/plugins/PluginFactoryExt.java:239:inplugin'", "org/logstash/plugins/PluginFactoryExt.java:137:in buildOutput'", "org/logstash/execution/JavaBasePipelineExt.java:50:ininitialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:in initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:36:inexecute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in `block in converge_state'"]}
[2019-06-20T10:21:43,083][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2019-06-20T10:21:48,014][INFO ][logstash.runner ] Logstash shut down.
EDIT:
I removed double quotes around "index" and "hosts" and removed the document_type , and tried to run the config file. I got no errors,in the end I got
[2019-06-20T10:21:48,014][INFO ][logstash.runner ] Logstash shut down.
I checked logstash status and it was still active, so what does shut down logstash mean when it is still active ? and why is it shutting down ?