Logstash Forwarder Error Log

Hi there,

Thanks a lot in advance.

I have configured the Logstash Forwarder on the cent os System but when i run the Logstash-forwarded .

i get this error message in the Error Log OF logstash Forwarder.

2015/05/14 06:31:33.326395 Failed unmarshalling json: invalid character '}' looking for beginning of object key string 2015/05/14 06:31:33.326543 Could not load config file /etc/logstash-forwarder.conf: invalid character '}' looking for beginning of object key string

can someone has any idea to help me out please.

thanks

Your configuration file isn't valid JSON. There are tons of JSON validators out there so it shouldn't be hard to find one that does a better job of pointing you to the exact spot where the error is, but otherwise you can post your configuration here to get help from human eyes.

{
# The network section covers network configuration :slight_smile:
"network": {
# A list of downstream servers listening for our messages.
# logstash-forwarder will pick one at random and only switch if
# the selected one appears to be dead or unresponsive
"servers": [ "10.30.1.119:6782" ],

**# The path to your client ssl certificate (optional)**
**#"ssl certificate": "/etc/logstash-forwarder/server.crt",**
**# The path to your client ssl key (optional)**
**#"ssl key": "./logstash-forwarder.key",**

**# The path to your trusted ssl CA file. This is used**
**# to authenticate your downstream server.**
**"ssl ca": "/etc/logstash-forwarder/server.crt",**

**# Network timeout in seconds. This is most important for**
**# logstash-forwarder determining whether to stop waiting for an**
**# acknowledgement from the downstream server. If an timeout is reached,**
**# logstash-forwarder will assume the connection or server is bad and**
**# will connect to a server chosen at random from the servers list.**
**#"timeout": 15**

},

# The list of files configurations
"files": [
# An array of hashes. Each hash tells what paths to watch and
# what fields to annotate on events from those paths.
{
"paths": [
# single paths are fine
"/var/log/messages"
# globs are fine too, they will be periodically evaluated
# to see if any new files match the wildcard.
"/var/log/vpnc/file.log"
],

  **# A dictionary of fields to annotate on each event.**
  **#"fields": { "type": "syslog" }**
**}, #{**
  **# A path of "-" means stdin.**
  **#"paths": [ "-" ],**
  **#"fields": { "type": "stdin" }**
**#}, {**
  **#"paths": [**
    **#"/var/log/apache/httpd-*.log"**
  **#],**
  **#"fields": { "type": "apache" }**
**#}**

],
}

This is my Configuration file!!

I have vpnc running on this machine and i am also trying to send this log to Logstash Server.

can Someone please help me with this!!!

Thanks In advance!

Your configuration ends with

  ],
}

but this should be (not absence of comma):

  ]
}

(Next time, please look into the formatting of your messages. Configuration file snippets benefit from being formatted as code. Just select the text block and press Ctrl+K.)

{
"network": {
"servers": [ "10.30.1.119:6782" ],
"ssl ca": "/etc/logstash-forwarder/server.crt",
"timeout": 15
},
"files": [
{
"paths": [
"/var/log/syslog",
"/var/log/*.log",
"/var/log/vpnc/file.log"
],
"fields": { "type": "syslog" }
},
{
"paths": [
"/var/log/apache2/*.log"
],
"fields": { "type": "apache" }
}
]
}

This Config File works for me! But now i get error message of SSL Handsake Issue! I have this Internal Env. nad using Self Signed Cert.

Failed to tls handshake with x.x.x.x x509: cannot validate certificate for x.x.x.x because it doesn't contain any IP SANs

Hi,

The "paths" list also seem to contain two strings without a comma separating them. As Magnus suggested, please use a JSON validator, e.g. JSONLint, to validate your configuration files.

Best regards,

Christian

Thanks Magnus and Christian for suggesting Json Validator