Logstash input sqs error

Elastic Stack Logstash
1

[ERROR] 2018-06-04 01:44:22.008 [[main]<sqs] json - JSON parse error, original data now in message field {:error=>#<LogStash::Json::ParserError: Unexpected character (' ' (code 32)) in numeric value: expected digit (0-9) to follow minus sign, for valid numeric value

at [Source: (String)"- [AppWallAttackSysLogMessage devType="null" destinationPort="54001" request="GET /webfig/roteros.info HTTP/1.1
Host: 94.188.210.31
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept: /
User-Agent: python-requests/2.18.4
X-RDWR-IP: 188.92.74.189
X-RDWR-PORT: 51224

" sourcePort="18762" role="public" aw....."}

[WARN ] 2018-06-04 01:52:22.849 [[main]<sqs] sqs - Aws::SQS::Errors::ServiceError ... retrying SQS request with exponential backoff {:queue=>"Prd-a99bc332-9da8-4c95-befe-9c6689fa0867-APPWALL_ATTACK", :sleep_time=>1, :error=>#<Aws::SQS::Errors::AccessDenied: Access to the resource https://sqs.us-west-2.amazonaws.com/148229479130/Prd-a99bc332-9da8-4c95-befe-9c6689fa0867-APPWALL_ATTACK is denied.>}

As shown above, when I use logstash to process sqs, some error happened. Have someone encountered same problem or help solve this problem? Thanks.

2

The default codec for the sqs input is "json" but you don't have JSON data. Change the codec to "plain" instead.

1 Like
3

Hi Rocky,

If you get solution, please post the input plugin configuration. I am also facing the same issue with parsing json logs.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.