Hello everyone,
For some reason my Logstash container keeps restarting itself and every time producing the output below:
Using bundled JDK: /usr/share/logstash/jdk
warning: no jvm.options file found
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/bundler-1.17.3/lib/bundler/rubygems_integration.rb:200: warning: constant Gem::ConfigMap is deprecated
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[INFO ] 2021-10-07 11:41:51.249 [main] runner - Starting Logstash {"logstash.version"=>"7.14.0", "jruby.version"=>"jruby 9.2.19.0 (2.5.8) 2021-06-15 55810c552b OpenJDK 64-Bit Server VM 11.0.11+9 on 11.0.11+9 +jit [linux-x86_64]"}
[INFO ] 2021-10-07 11:41:51.266 [main] writabledirectory - Creating directory {:setting=>"path.queue", :path=>"/usr/share/logstash/data/queue"}
[INFO ] 2021-10-07 11:41:51.268 [main] writabledirectory - Creating directory {:setting=>"path.dead_letter_queue", :path=>"/usr/share/logstash/data/dead_letter_queue"}
[WARN ] 2021-10-07 11:41:51.783 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2021-10-07 11:41:51.797 [LogStash::Runner] agent - No persistent UUID file found. Generating new UUID {:uuid=>"5d46e07a-50f8-41ea-bf8c-a961b1910c49", :path=>"/usr/share/logstash/data/uuid"}
[ERROR] 2021-10-07 11:41:52.784 [Converge PipelineAction::Create<main>]
agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main,
:exception=>"LogStash::ConfigurationError",
:message=>"Expected one of [ \\t\\r\\n], \"#\", \"=>\" at line 3, column 10
(byte 27) after input {\n imap {\n host ",
:backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'",
"org/logstash/execution/AbstractPipelineExt.java:187:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'",
"/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'",
"/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:391:in `block in converge_state'"]}
[INFO ] 2021-10-07 11:41:52.802 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[INFO ] 2021-10-07 11:41:52.864 [LogStash::Runner] runner - Logstash shut down.
Does anybody have an idea what could be a problem? It used to work before with the same configuration file I'm using right now(no changes in the file whatsoever). But now it seems to not like the imap definition(at least that's what log refers to):
input {
imap {
host = > "${IMAP_ACCOUNT_HOST}"
user = > "${IMAP_ACCOUNT_USER}"
password = > "${IMAP_ACCOUNT_PASSWORD}"
port = > "${IMAP_ACCOUNT_PORT}"
}
}
I'm using Logstash v7.14.0 image.
Here's my docker-compose configuration:
image: docker.elastic.co/logstash/logstash:7.14.0
command: "-f '/usr/share/logstash/pipeline/logstash.conf'"
restart: always
env_file:
- ./logstash/logstash-pipeline.properties
volumes:
- type: bind
source: ./logstash/config
target: /usr/share/logstash/config
read_only: true
- type: bind
source: ./logstash/pipeline/
target: /usr/share/logstash/pipeline/
read_only: true
The configuration files are all located in the same directory as docker-compose.yml under logstash folder.