Hello community,
I use Logstash in centos 7 and when I start it, it gives the following error
**[2020-07-23T10:37:01,699][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"6.8.10"}**
**[2020-07-23T10:37:10,140][INFO ][logstash.pipeline ] Starting pipeline {:pipeline_id=>"main", "pipeline.workers"=>2, "pipeline.batch.size"=>125, "pipeline.batch.delay"=>50}**
**[2020-07-23T10:37:10,963][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[https://localhost:9200/]}}**
**[2020-07-23T10:37:11,330][ERROR][logstash.pipeline ] Error registering plugin {:pipeline_id=>"main", :plugin=>"#<LogStash::OutputDelegator:0x728d30fe>", :error=>"Unrecognized SSL message, plaintext connection?", :thread=>"#<Thread:0x36cc8312 run>"}**
**[2020-07-23T10:37:11,343][ERROR][logstash.pipeline ] Pipeline aborted due to error {:pipeline_id=>"main", :exception=>#<Manticore::UnknownException: Unrecognized SSL message, plaintext connection?>, :backtrace=>["/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:37:in `block in initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/manticore-0.6.4-java/lib/manticore/response.rb:79:in `call'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client/manticore_adapter.rb:74:in `perform_request'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:291:in `perform_request_to_url'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:245:in `block in healthcheck!'", "org/jruby/RubyHash.java:1419:in `each'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:241:in `healthcheck!'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:341:in `update_urls'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client/pool.rb:71:in `start'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:302:in `build_pool'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client.rb:64:in `initialize'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:103:in `create_http_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/http_client_builder.rb:99:in `build'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch.rb:238:in `build_client'", "/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/logstash-output-elasticsearch-9.4.0-java/lib/logstash/outputs/elasticsearch/common.rb:25:in `register'", "org/logstash/config/ir/compiler/OutputStrategyExt.java:106:in `register'", "org/logstash/config/ir/compiler/AbstractOutputDelegatorExt.java:48:in `register'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:259:in `register_plugin'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `block in register_plugins'", "org/jruby/RubyArray.java:1792:in `each'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:270:in `register_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:611:in `maybe_setup_out_plugins'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:280:in `start_workers'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:217:in `run'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:176:in `block in start'"], :thread=>"#<Thread:0x36cc8312 run>"}**
**[2020-07-23T10:37:11,378][ERROR][logstash.agent ] Failed to execute action {:id=>:main, :action_type=>LogStash::ConvergeResult::FailedAction, :message=>"Could not execute action: PipelineAction::Create<main>, action_result: false", :backtrace=>nil}**
**[2020-07-23T10:37:11,870][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}**
**[2020-07-23T10:37:16,604][INFO ][logstash.runner ] Logstash shut down.**
It then starts again, throws the same error and keeps repeating.
This is my .conf file:
input {
syslog {
port => 514
type => "panw"
tags => [ "PAN-OS_SysLog" ]
}
udp {
port => 5545
#grok_pattern => "<%{POSINT:priority_test}>%{NUMBER:log_sequence}: %{DATA:device}: %{NOTSPACE}syslog@9 s_id =\"%{DATA:hostname}:%{POSINT:from_port}\"%{NOTSPACE}:
#%{CISCOTIMESTAMP:date_received}: %%{DATA:facility}-%{POSINT:log_severity:int}-%{DATA:mnemonic}: %{GREEDYDATA:log_msg}"
}
beats {
port => 5044
type => "winlogbeat"
}
udp {
port => 5515
type => "networking"
}
udp {
port => 5513
codec => "json"
type => "linux"
}
udp{
port => 5516
type => "other"
}
}
output {
if [type] == "linux" {
elasticsearch {
hosts => "https://localhost:9200"
index => "linux-%{+YYYY.MM.dd}"
}
}else if [type] == "filebeat" {
elasticsearch {
hosts => "https://localhost:9200"
#manage_template => false
index => "filebeat-%{+YYYY.MM.dd}"
#pipeline => "filebeat-7.3.2-panw-panos-pipeline"
#pipeline => "%{[@metadata][pipeline]}"
}
}else if [type] == "winlogbeat"{
elasticsearch {
hosts => "https://localhost:9200"
index => "winlogbeat-%{+YYYY.MM.dd}"
}
}else if [type] == "networking"{
elasticsearch {
hosts => "https://localhost:9200"
index => "networking-%{+YYYY.MM.dd}"
}
}else{
elasticsearch {
hosts => "https://localhost:9200"
index => "notype-%{+YYYY.MM.dd}"
}
}
}
Anyone can see any possible fix here?