Logstash keeps restarting itself

Hello everyone,

For some reason my Logstash container keeps restarting itself and every time producing the output below:

Using bundled JDK: /usr/share/logstash/jdk
warning: no jvm.options file found
/usr/share/logstash/vendor/bundle/jruby/2.5.0/gems/bundler-1.17.3/lib/bundler/rubygems_integration.rb:200: warning: constant Gem::ConfigMap is deprecated
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs errors to the console
[INFO ] 2021-10-07 11:41:51.249 [main] runner - Starting Logstash {"logstash.version"=>"7.14.0", "jruby.version"=>"jruby 9.2.19.0 (2.5.8) 2021-06-15 55810c552b OpenJDK 64-Bit Server VM 11.0.11+9 on 11.0.11+9 +jit [linux-x86_64]"}
[INFO ] 2021-10-07 11:41:51.266 [main] writabledirectory - Creating directory {:setting=>"path.queue", :path=>"/usr/share/logstash/data/queue"}
[INFO ] 2021-10-07 11:41:51.268 [main] writabledirectory - Creating directory {:setting=>"path.dead_letter_queue", :path=>"/usr/share/logstash/data/dead_letter_queue"}
[WARN ] 2021-10-07 11:41:51.783 [LogStash::Runner] multilocal - Ignoring the 'pipelines.yml' file because modules or command line options are specified
[INFO ] 2021-10-07 11:41:51.797 [LogStash::Runner] agent - No persistent UUID file found. Generating new UUID {:uuid=>"5d46e07a-50f8-41ea-bf8c-a961b1910c49", :path=>"/usr/share/logstash/data/uuid"}

[ERROR] 2021-10-07 11:41:52.784 [Converge PipelineAction::Create<main>] 
agent - Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main,
:exception=>"LogStash::ConfigurationError", 
:message=>"Expected one of [ \\t\\r\\n], \"#\", \"=>\" at line 3, column 10
(byte 27) after input {\n  imap {\n    host ", 
:backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", 
"org/logstash/execution/AbstractPipelineExt.java:187:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'",
"/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'",
"/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:391:in `block in converge_state'"]}

[INFO ] 2021-10-07 11:41:52.802 [Api Webserver] agent - Successfully started Logstash API endpoint {:port=>9600}
[INFO ] 2021-10-07 11:41:52.864 [LogStash::Runner] runner - Logstash shut down.

Does anybody have an idea what could be a problem? It used to work before with the same configuration file I'm using right now(no changes in the file whatsoever). But now it seems to not like the imap definition(at least that's what log refers to):

input {
  imap {
    host = > "${IMAP_ACCOUNT_HOST}"
    user = > "${IMAP_ACCOUNT_USER}"
    password = > "${IMAP_ACCOUNT_PASSWORD}"
    port = > "${IMAP_ACCOUNT_PORT}"
  }
}

I'm using Logstash v7.14.0 image.

Here's my docker-compose configuration:

    image: docker.elastic.co/logstash/logstash:7.14.0
    command: "-f '/usr/share/logstash/pipeline/logstash.conf'"
    restart: always
    env_file:
      - ./logstash/logstash-pipeline.properties
    volumes:
      - type: bind
        source: ./logstash/config
        target: /usr/share/logstash/config
        read_only: true
      - type: bind
        source: ./logstash/pipeline/
        target: /usr/share/logstash/pipeline/
        read_only: true

The configuration files are all located in the same directory as docker-compose.yml under logstash folder.

=> instead of = >

Ahh! Thank you, didn't even notice. Must be IDEA auto formatted it.

1 Like

You are welcomed @grigala, welcome to the community !