Logstash Forwarder Error Log

Elastic Stack Logstash
1

Hi there,

Thanks a lot in advance.

I have configured the Logstash Forwarder on the cent os System but when i run the Logstash-forwarded .

i get this error message in the Error Log OF logstash Forwarder.

2015/05/14 06:31:33.326395 Failed unmarshalling json: invalid character '}' looking for beginning of object key string 2015/05/14 06:31:33.326543 Could not load config file /etc/logstash-forwarder.conf: invalid character '}' looking for beginning of object key string

can someone has any idea to help me out please.

thanks

2

Your configuration file isn't valid JSON. There are tons of JSON validators out there so it shouldn't be hard to find one that does a better job of pointing you to the exact spot where the error is, but otherwise you can post your configuration here to get help from human eyes.

3

{
# The network section covers network configuration :slight_smile:
"network": {
# A list of downstream servers listening for our messages.
# logstash-forwarder will pick one at random and only switch if
# the selected one appears to be dead or unresponsive
"servers": [ "10.30.1.119:6782" ],

**# The path to your client ssl certificate (optional)**
**#"ssl certificate": "/etc/logstash-forwarder/server.crt",**
**# The path to your client ssl key (optional)**
**#"ssl key": "./logstash-forwarder.key",**

**# The path to your trusted ssl CA file. This is used**
**# to authenticate your downstream server.**
**"ssl ca": "/etc/logstash-forwarder/server.crt",**

**# Network timeout in seconds. This is most important for**
**# logstash-forwarder determining whether to stop waiting for an**
**# acknowledgement from the downstream server. If an timeout is reached,**
**# logstash-forwarder will assume the connection or server is bad and**
**# will connect to a server chosen at random from the servers list.**
**#"timeout": 15**

},

# The list of files configurations
"files": [
# An array of hashes. Each hash tells what paths to watch and
# what fields to annotate on events from those paths.
{
"paths": [
# single paths are fine
"/var/log/messages"
# globs are fine too, they will be periodically evaluated
# to see if any new files match the wildcard.
"/var/log/vpnc/file.log"
],

  **# A dictionary of fields to annotate on each event.**
  **#"fields": { "type": "syslog" }**
**}, #{**
  **# A path of "-" means stdin.**
  **#"paths": [ "-" ],**
  **#"fields": { "type": "stdin" }**
**#}, {**
  **#"paths": [**
    **#"/var/log/apache/httpd-*.log"**
  **#],**
  **#"fields": { "type": "apache" }**
**#}**

],
}

This is my Configuration file!!

I have vpnc running on this machine and i am also trying to send this log to Logstash Server.

can Someone please help me with this!!!

Thanks In advance!

4

Your configuration ends with

  ],
}

but this should be (not absence of comma):

  ]
}

(Next time, please look into the formatting of your messages. Configuration file snippets benefit from being formatted as code. Just select the text block and press Ctrl+K.)

5 
{
"network": {
"servers": [ "10.30.1.119:6782" ],
"ssl ca": "/etc/logstash-forwarder/server.crt",
"timeout": 15
},
"files": [
{
"paths": [
"/var/log/syslog",
"/var/log/*.log",
"/var/log/vpnc/file.log"
],
"fields": { "type": "syslog" }
},
{
"paths": [
"/var/log/apache2/*.log"
],
"fields": { "type": "apache" }
}
]
}

This Config File works for me! But now i get error message of SSL Handsake Issue! I have this Internal Env. nad using Self Signed Cert.

Failed to tls handshake with x.x.x.x x509: cannot validate certificate for x.x.x.x because it doesn't contain any IP SANs

6

Hi,

The "paths" list also seem to contain two strings without a comma separating them. As Magnus suggested, please use a JSON validator, e.g. JSONLint, to validate your configuration files.

Best regards,

Christian

7

Thanks Magnus and Christian for suggesting Json Validator