Logstash error while testing the config file

hI All,

my All servers are in azure cloud ..

All Applications are running on java 1.7.0

I have running logstash version is 2.1.2

if i ran the bin\logstash -f conf\some.conf --config.reload.automatic getting below msg

C:\SoftwareInstalls\logstash-2.1.2>bin\logstash -f conf\some.conf --config.reload.automatic

io/console not supported; tty will not be manipulated

Clamp::UsageError: Unrecognised option '--config.reload.automatic'

signal_usage_error at C:/SoftwareInstalls/logstash-2.1.2/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:103

     find_option at C:/SoftwareInstalls/logstash-2.1.2/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/option/parsing.rb:62

   parse_options at C:/SoftwareInstalls/logstash-2.1.2/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/option/parsing.rb:28

           parse at C:/SoftwareInstalls/logstash-2.1.2/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:52

             run at C:/SoftwareInstalls/logstash-2.1.2/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.2-java/lib/logstash/runner.rb:79

            call at org/jruby/RubyProc.java:281

             run at C:/SoftwareInstalls/logstash-2.1.2/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.2-java/lib/logstash/runner.rb:95

            call at org/jruby/RubyProc.java:281

      initialize at C:/SoftwareInstalls/logstash-2.1.2/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/task.rb:24

When I installed logstash 5.4 version and java version 1.8 on my desktop .that time log generated. I didn't find any errors on that log file.

Logstash configuration "


input {

file {

    path => "C:\SoftwareInstalls\testingfilebeat.log"

    start_position => "beginning"

}

}

filter {

if [path] =~ "access" {

    mutate { replace => { "type" => "apache_access" } }

    grok {

        match => { "message" => "%{COMBINEDAPACHELOG}" }

    }

}

}

output {

)

logfile :


64.242.88.10 - - [07/Mar/2004:16:05:49 -0800] "GET /twiki/bin/edit/Main/Double_bounce_sender?topicparent=Main.ConfigurationVariables HTTP/1.1" 401 12846

64.242.88.10 - - [07/Mar/2004:16:06:51 -0800] "GET /twiki/bin/rdiff/TWiki/NewUserTemplate?rev1=1.3&rev2=1.2 HTTP/1.1" 200 4523

64.242.88.10 - - [07/Mar/2004:16:10:02 -0800] "GET /mailman/listinfo/hsdivision HTTP/1.1" 200 6291

64.242.88.10 - - [07/Mar/2004:16:11:58 -0800] "GET /twiki/bin/view/TWiki/WikiSyntax HTTP/1.1" 200 7352

Thanks

Gopi s

8187871065

I believe automatic reloading of config was introduced in Logstash 2.3, which would explain why it works on 5.4 but not with version 2.1.

Thank you for your quick response.

i have installed 2.3 and it's working fine now. Need one more help . my logs file look like below.

logfile

{
"SourceId" : "123",
"EventId" : "6",
"Keywords" : "2",
"Level" : "ve",
"Message" : "",
"Opcode" : "Info",
"Task" : "123 Information",
"Version" : "0",
"Timestamp" : "2018-09-10T15:09:29.9617308Z",
"Payload_message" : "Received Message",
"Payload_Service Name" : "home",
"Payload_OriginatingMessageId" : "123",
"Payload_Status" : "OK",
"EOE" : ""
}
{
"SourceId" : "1234",
"EventId" : "6",
"Keywords" : "2",
"Level" : "ver",
"Message" : "",
"Opcode" : "Infy",
"Task" : "123 Information",
"Version" : "0",
"Timestamp" : "2018-09-10T15:09:29.9617308Z",
"Payload_message" : "Received Message",
"Payload_Service Name" : "homes",
"Payload_OriginatingMessageId" : "1234",
"Payload_Status" : "OK",
"EOE" : ""
}

logstash configuration

input {
file {
path => "C:\Logs\testingfilebeat.log"
start_position => "beginning"
}
}

filter {
if [path] =~ "access" {
mutate { replace => { "type" => "Applog" } }
grok {
match => { "message" => "%{COMBINEDAPACHELOG}" }
}
}
json {
source => "message"
}
}

as of now it's taking the individual line in one record.

OUTPUT

{
"message" => "{\r",
"@version" => "1",
"@timestamp" => "2018-09-11T13:20:32.973Z",
"path" => "C:\Logs\testingfilebeat.log",
"host" => "dev1"
}
{
"message" => ""SourceId" : "1234",\r",
"@version" => "1",
"@timestamp" => "2018-09-11T13:20:32.973Z",
"path" => "C:\Medseek\Logs\testingfilebeat.log",
"host" => "dev1"
}

problem is it's storing the individual line in to one record, like { is storing one record and source id storing another record .

i need to store { to } totally in one record . what configuration need to do ..

could you please help me on this

regards
gopi

Can you plz help me on this.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.