[2021-06-18T08:21:45,675][INFO ][logstash.runner ] Log4j configuration path used is: /etc/logstash/log4j2.properties
[2021-06-18T08:21:45,686][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.13.2", "jruby.version"=>"jruby 9.2.16.0 (2.5.7) 2021-03-03 f82228dc32 OpenJDK 64-Bit Server VM 11.0.11+9 on 11.0.11+9 +indy +jit [linux-x86_64]"}
[2021-06-18T08:21:46,858][INFO ][logstash.config.source.local.configpathloader] No config files found in path {:path=>"/etc/logstash/conf.d/*.conf"}
[2021-06-18T08:21:46,883][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
[2021-06-18T08:21:47,116][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2021-06-18T08:21:52,198][INFO ][logstash.runner ] Logstash shut down.
[2021-06-18T08:21:52,216][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.16.0.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.16.0.jar:?]
at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstash/lib/bootstrap/environment.rb:89) ~[?:?]
This is my conf file
input {
udp {
port => 5044
type => "syslog"
}
}
filter{
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{USERNAME:hostname}%{DATA:syslog_program}:%{GREEDYDATA:syslog_message}" }
}
date {
match => [ "timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
ruby {
code => "
fieldArray = event.get('syslog_message').split(' ');
for field in fieldArray
name = field.split('=')[0];
value = field.split('=')[1];
if value =~ /[0-9]/
if value =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/
event.set(name, value)
else
if value =~ /[A-z]/
event.set(name, value)
else
event.set(name, value.to_i)
end
end
else
event.set(name, value)
end
end
"
}
}
}
output {
elasticsearch {
ilm_enabled => false
hosts => ['https://elastic.sys:9200']
cacert => '/etc/logstash/certs/ca.crt'
user => 'logstash_writer'
password => 'LiL14stC0M0BZw9iBAY9'
index => "syslog"
}
stdout { codec => rubydebug }
}
sudo service logstash start
Yes I have already restart the service.
Logstash create index in kibana when I use HTTP but when I try ELK in HTTPS then not creating index in kibana.
I have check logs of Elasticsearch ,there is no any error and in logstash log file last log is 18 june 2021 after that log is not created in logstash.
The log of logstash are
[2021-06-18T08:21:45,686][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.13.2", "jruby.version"=>"jruby 9.2.16.0 (2.5.7) 2021-03-03 f82228dc32 OpenJDK 64-Bit Server VM 11.0.11+9 on 11.0.11+9 +indy +jit [linux-x86_64]"}
[2021-06-18T08:21:46,858][INFO ][logstash.config.source.local.configpathloader] No config files found in path {:path=>"/etc/logstash/conf.d/*.conf"}
[2021-06-18T08:21:46,883][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
[2021-06-18T08:21:47,116][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2021-06-18T08:21:52,198][INFO ][logstash.runner ] Logstash shut down.
[2021-06-18T08:21:52,216][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.16.0.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.16.0.jar:?]
at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstash/lib/bootstrap/environment.rb:89) ~[?:?]
I have changed as you said and restart the logstash but as I said earlier that after 18 june 2021 logs is not created in logstash log file so unable to check the logs.
I'd like to know if this message is cleared or not.
[2021-06-18T08:21:46,883][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
If you are saying these log is not updated after the restart on Aug 12 , then something is wrong with your logstash installation. Next , you should check journal logs , e.g journalctl -b 0
[2021-06-18T08:21:45,675][INFO ][logstash.runner ] Log4j configuration path used is: /etc/logstash/log4j2.properties
[2021-06-18T08:21:45,686][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"7.13.2", "jruby.version"=>"jruby 9.2.16.0 (2.5.7) 2021-03-03 f82228dc32 OpenJDK 64-Bit Server VM 11.0.11+9 on 11.0.11+9 +indy +jit [linux-x86_64]"}
[2021-06-18T08:21:46,858][INFO ][logstash.config.source.local.configpathloader] No config files found in path {:path=>"/etc/logstash/conf.d/*.conf"}
[2021-06-18T08:21:46,883][ERROR][logstash.config.sourceloader] No configuration found in the configured sources.
[2021-06-18T08:21:47,116][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600}
[2021-06-18T08:21:52,198][INFO ][logstash.runner ] Logstash shut down.
[2021-06-18T08:21:52,216][FATAL][org.logstash.Logstash ] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.16.0.jar:?]
at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.16.0.jar:?]
at usr.share.logstash.lib.bootstrap.environment.<main>(/usr/share/logstash/lib/bootstrap/environment.rb:89) ~[?:?]
Also , you should restart logstash by sudo service logstash restart not sudo service logstash start. Stop then Start will be more solid instead of reloading the config.
sudo service logstash stop
sudo service logstash start
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.